Windows antivirus alert when running OpenCode.

[iceriver20002000]

Question

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode #7919: Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode
• [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode
• Windows Defender says Found Trojan #7821: Windows Defender says Found Trojan
• Threat Found. Trojan:Script/Wacatac.H!ml #7669: Threat Found. Trojan:Script/Wacatac.H!ml
• Running opencode is flagged as trojan on windows - Installed through Node Package Manager #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager
• Windows Defender falsely flags new releases as trojans #3415: Windows Defender falsely flags new releases as trojans
• v0.15.16 was infected by a virus and removed by Windows Security #3406: v0.15.16 was infected by a virus and removed by Windows Security

Feel free to ignore if none of these address your specific case.

[BaseBlank]

I encountered exactly the same bug.

Trojan:Script/Wacatac.C!ml

[magicprinc]

any chance? 😭

[BaseBlank]

The current solution is to use the old version and disable any upgrades.
Alternatively, you can ignore the warnings from Windows Defender and continue using the system, but I do not recommend this approach.
It’s best to wait patiently for the author to fix this issue.

[okazakov]

Alternatively, you can ignore the warnings from Windows Defender and continue using the system

Well... you can't ignore it. The DLL that triggers Windows Defender keeps changing name every time Windows Defender blocks it. It's kinda chicken & egg situation that prevents us from adding it into exclusions. You don't know the name of the DLL until you run OpenCode, and once you run it, Windows Defender blocks the file and removes it. And you can go in circles indefinitely.

[norm2782]

The current solution is to use the old version and disable any upgrades. Alternatively, you can ignore the warnings from Windows Defender and continue using the system, but I do not recommend this approach. It’s best to wait patiently for the author to fix this issue.

What is the latest version that does not have this problem?

[vip32]

this just happened to me with the latest 1.1.23 version. downgrading to 1.1.20 makes the trojan alert go away.

npm install -g opencode-ai@1.1.20

i also note that opencode updates itself automaticaly to 1.1.23 when i ran it as 1.1.20. hows that? for now i can workaround that with npx opencode-ai@1.1.20

[marko-hologram]

It's not just Windows Defender, it's Smart App Control that blocks the app from running. You also shouldn't disable Smart App Control because you cannot enable it again without doing a fresh Windows install.

I tried just disabling various Windows Defender features and some in Smart App Control and I cannot get opencode to work. Worked fine like 8-10 hours ago. I guess it got updated when I ran it now?

I've seen the team is working on code signing which should make things work fine so I guess we just have to wait in order to use latest version.

---

Using npx opencode-ai@1.1.21, or bunx opencode-ai@1.1.21 seems to work fine at the moment. If you work with opencode a lot in a single repo, I'd suggest installing it there as a dev dependency (e.g npm i -D opencode-ai@1.1.21) and then just doing npx opencode-ai in that folder so that you don't have to type the version each time.

[AamiRobin]

I ran into this issue, reinstalled Windows, and it worked for a day, but now it’s back again. I have no idea what’s causing it. I also have two PCs—it works fine on one but not the other, which is really confusing.

[jMerta]

Happens to me on my corproate laptop when I finally got approved to use it through Copilot. :(

On personal works just fine.