Trojan: Script/Wacatac.H!m!

[rony53]

Description

After update 1.2.20 when i try to open opencode in my windows then i get this notfication Trojan: Script/Wacatac.H!m! and my opencode not opend. why is that happend ? and opencode not responceed any commend .

Plugins

No response

OpenCode version

1.2.20

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

Windows 11

Terminal

PowerShell

[github-actions]

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

• Several required fields are empty: OpenCode version, Operating System, Terminal, and Steps to reproduce — these are important for diagnosing the issue and should be filled in.

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

---

This issue might be a duplicate of existing issues. Please check:

• [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode
• Threat Found. Trojan:Script/Wacatac.H!ml #7669: Threat Found. Trojan:Script/Wacatac.H!ml
• Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode #7919: Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode
• Windows Defender Detected: Trojan:Win32/Wacatac.H!ml #13517: Windows Defender Detected: Trojan:Win32/Wacatac.H!ml
• When I use OpenCode, Windows Defender pops up a security threat #16305: When I use OpenCode, Windows Defender pops up a security threat

If you believe this was flagged incorrectly, please let a maintainer know.

[Hona]

Can you please attach a screen recording

[github-actions]

Thanks for updating the issue description! However, a few required fields are still empty:

• Steps to reproduce — please describe what you did that triggered the Windows Defender notification (e.g., downloaded the installer, ran a specific command, etc.)
• Operating System — please provide your Windows version (e.g., Windows 11 22H2)
• Terminal — please specify which terminal you were using (e.g., Windows Terminal, PowerShell, CMD)

These details help maintainers investigate and reproduce the issue. Please edit the issue to fill them in.

[TotoCodeFR]

I am currently having the same issue: Windows 11 25H2, Windows Terminal, once opening OpenCode.

OpenCode's TUI does not open, and a DLL that goes into my AppData Temp folder gets detected

[Flybring]

Yeah, I have the same issue as well, started yesterday.

[rony53]

its happend after update 1.2.20

[github-actions]

Thank you for updating the issue! It now meets our contributing guidelines. We appreciate you taking the time to provide the details.

[TotoCodeFR]

Making a video now

[TotoCodeFR]

Cap.2026-03-06.at.09.53.34.mp4

[TotoCodeFR]

Also, Ctrl+C doesn't work to kill it.