Malicious code in opencode-optimised-toolings (npm)
opencode-optimised-toolings@4.0.0 contains malicious code that downloads and builds an unauthorized opencode binary from a non-publisher GitHub repository, replaces the legitimate opencode executable on the user's PATH, and establishes persistent code execution with user privileges. The package modifies configuration files to ensure the malicious pipeline continues on future invocations.
- Disclosed
- Last updated
- Blast radius
- Users who installed opencode-optimised-toolings@4.0.0 and any subsequent invocations of the opencode CLI on affected systems
- Ecosystems
- Attack vectors
- Affected entities
- opencode-optimised-toolings · 4.0.0
opencode-optimised-toolings@4.0.0 executes a SelfPatchPlugin.runSelfPatch() routine on plugin load without user consent. This routine downloads an OpenCode source tarball from github.com/anomalyco/opencode (distinct from the legitimate upstream sst/opencode project), runs bun install and a build process, then replaces the legitimate opencode executable on the user's PATH with the attacker-built binary.
The malicious binary is renamed to the original opencode executable path, giving the attacker persistent code execution with the user's privileges on all subsequent invocations of the opencode command, both within and outside the plugin context.
Persistence is reinforced through migrateInstalledConfig, which rewrites configuration files at ~/.config/opencode/opencode.jsonc and ~/.config/opencode/tui.json on each load, injecting ALONIX-marked blocks and pinning opencode-optimised-toolings@latest to ensure the self-patch pipeline continues to execute on future opencode launches.
The attack lacks integrity verification: the upstream archive URL uses a mutable version tag with no full-tree hash or signature verification, and the manifest fingerprints only ~7 files while the entire compiled tarball becomes the replacement binary.
Indicators of compromise
- Packages
- opencode-optimised-toolings@4.0.0
- Domains
- github.com/anomalyco/opencode
Remediation
- Immediately uninstall opencode-optimised-toolings from all systems
- Restore the legitimate opencode executable from backups or reinstall from the official sst/opencode repository
- Audit ~/.config/opencode/ configuration files for ALONIX-marked blocks and remove any injected content
- Review command history and system logs for unauthorized code execution during the period the malicious package was installed
- Verify the integrity of any artifacts or builds produced while the malicious opencode binary was in use
- Update to a patched version of opencode-optimised-toolings if one is released, or use an alternative tool
Sources
- GitHub Advisory GHSA-49cx-27xq-h4g2 · GitHub Advisory Database
Cite this entry
"Malicious code in opencode-optimised-toolings (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-opencode-optimised-toolings-npm-azjti2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in sysdo (npm)
The npm package sysdo was published with malicious code that installs a Windows surveillance harness disguised as a system configuration tool. The payload captures keyboard input, clipboard contents, screenshots, and UI text, exfiltrating data to a hardcoded endpoint controlled by the attacker.
npmCompromised packageMalicious maintainer - containedcritical
Malicious code in twapfetch (npm)
twapfetch@1.1.0 on npm contains a malicious postinstall script that downloads and executes arbitrary code from a mutable, author-controlled URL with no integrity verification. The package misrepresents its purpose (claiming to be a Polymarket Chainlink TWAP client) while actually shipping Kelly-stake math helpers and a remote-bundle loader.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in blekit (npm)
The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.
npmCompromised packageMalicious maintainer - activecritical
Malicious code in aclade-agent (npm)
The npm package aclade-agent contains malicious code that establishes a daemon polling a remote server (aclade.com) for arbitrary task execution, including bash commands, filesystem operations, and scheduled persistence. The package automatically updates itself globally, allowing any future compromise of the maintainer account to propagate automatically to all running instances.
npmCompromised packageMalicious maintainer