Supply chain · npm · Critical

Critical Malware Alert: 'opencode2-windows-x64' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-10-13

The npm package 'opencode2-windows-x64' has been identified as malware, leading to full system compromise upon installation. All secrets and keys on affected machines must be rotated immediately from a separate, secure system.

  • Package: npm / opencode2-windows-x64
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~5,087/wk
  • Exposure: 80/100 (Critical)

What happened — Credential / secret theft

The npm package 'opencode2-windows-x64' contains malware. Installation of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate or dependency package introduces harmful code into a development or production environment. Upon installation, the malicious code executes, establishing unauthorized control over the system and potentially exfiltrating sensitive data.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'opencode2-windows-x64'

Conditions that increase exposure

  • Unpinned or broad dependency ranges for 'opencode2-windows-x64'
  • Lack of package lockfiles (e.g., package-lock.json) in projects
  • Automated builds or deployments that fetch the latest versions of dependencies
  • Use of internal package mirrors that have synchronized the malicious version

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets, keys, and credentials stored on the affected computer are exposed and can be stolen.
  • The attacker can establish persistence, making simple package removal insufficient for remediation.
  • Compromised systems can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan package dependencies for 'opencode2-windows-x64' across all projects.
  • Review build logs and dependency trees for any installation of the package.
  • Monitor network traffic for unusual outbound connections from systems that installed the package.

Contain

  • Immediately isolate any system identified with 'opencode2-windows-x64' installed.
  • Block 'opencode2-windows-x64' from being downloaded or installed in your environment.
  • Revoke access tokens and credentials used by compromised systems.

Remediate

  • Consider any system that installed 'opencode2-windows-x64' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) that were stored on or accessible from the compromised computer, performing this action from a different, secure system.
  • Implement strict dependency version pinning and review processes for new package introductions.

Frontier verdict — Critical

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system rebuild for any affected npm environment.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.