Malicious code in opencode-skills-collection (npm)
Published Sources: OSV (Schadpakete)
- Malicious package
What is affected, what to do
Uninstall the package, isolate affected environments and rotate credentials that were available during installation.
Not sure whether and how you are affected? Ask a question about this vulnerability
Malicious package
npmopencode-skills-collection
“opencode-skills-collection” is registered as malicious in the npm repository. Anyone who installed the package should uninstall it immediately, isolate affected environments and rotate credentials that were present during installation.
Affected versions (23)
- 4.0.56
- 4.0.57
- 4.0.77
- 4.1.0
- 4.1.1
- 4.1.10
- 4.1.11
- 4.1.12
- 4.1.13
- 4.1.14
- 4.1.16
- 4.1.17
- 4.1.18
- 4.1.19
- 4.1.2
- 4.1.20
- 4.1.3
- 4.1.4
- 4.1.5
- 4.1.6
- 4.1.7
- 4.1.8
- 4.1.9
purl: pkg:npm/opencode-skills-collection
Sources (24)
ghsa-malware
GHSA-9855-prwc-mfp2Versions from this source: 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18
sha256: c84dd18445ee7b0f29f3f76c81efb76a43fa7ef77d4c99b57245f4ef8e72a13a
ghsa-malware
GHSA-9855-prwc-mfp2Versions from this source: 4.1.20, 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18
sha256: 7f9554768223a627ad7704e8825b53cf38951547f35dd2e747b067560562979f
amazon-inspector
IN-MAL-2026-022114Versions from this source: 4.1.1
sha256: 0ef3ce32c66764fd843324fcbf0467d95e38ded4c3778358f9a9983e1d88eb81
amazon-inspector
IN-MAL-2026-022185Versions from this source: 4.1.6
sha256: 0f6060bf9b062de87030e116099177fe1139d8fe492d3b7916ebf2bb0f4dc939
amazon-inspector
IN-MAL-2026-022246Versions from this source: 4.1.11
sha256: 959d4111548af2c6606e3348b009a9d438424db418dd2bc2f101aac2b0435793
amazon-inspector
IN-MAL-2026-022179Versions from this source: 4.1.13
sha256: a0cc548c85008df9fb80c0c1883b39b2f7c019249d718085741380252fcc0a3f
amazon-inspector
IN-MAL-2026-022090Versions from this source: 4.1.12
sha256: ad4663af5b87079e1a7cdbfd6f3626801e542f7fdfe79316dec31974dd625941
amazon-inspector
IN-MAL-2026-022121Versions from this source: 4.1.0
sha256: 154334b82c927a191e91994f527d770cb3f984c95740d832dd760aaff4251795
amazon-inspector
IN-MAL-2026-022180Versions from this source: 4.1.17
sha256: 2805226ddecf93034c614e75b1fde8f3479ba9d176b2be077c27265b8afaaf42
amazon-inspector
IN-MAL-2026-022184Versions from this source: 4.1.7
sha256: 4b370ecef32f75c304234d95aad45075178c1bb0f49b6390b3cdcf3c34b11ee0
amazon-inspector
IN-MAL-2026-022187Versions from this source: 4.1.3
sha256: 51a4eccc4d08f6fd3317d32a94cc65ae89145009b24ba50d8f0b810e8c90684b
amazon-inspector
IN-MAL-2026-022115Versions from this source: 4.0.77
sha256: ea84433517366e479ab384361feea9117886b596b1dded9a54e0367339cc48d1
amazon-inspector
IN-MAL-2026-022186Versions from this source: 4.1.4
sha256: f04ac946536f534c434638c42208b1b28e6b53c6d02b8dcdd263bc62d87a54ef
amazon-inspector
IN-MAL-2026-022183Versions from this source: 4.1.8
sha256: 0029ec54bda52537cccd9a907342f8a9fd1958e28fa1669f2f980ceb86a0930e
amazon-inspector
IN-MAL-2026-022178Versions from this source: 4.1.18
sha256: 0da45f9abc383cb78a9938c7a162879afdf4a04a257aa3f255608af37972844f
amazon-inspector
IN-MAL-2026-022113Versions from this source: 4.1.10
sha256: 5b3fc933b0130a8a2a8c3f52762f75ccdfea61ecb6049ce6beac9c332837d91b
amazon-inspector
IN-MAL-2026-022112Versions from this source: 4.1.16
sha256: 6fc59e1e0fe7b6cf0424a43decc7ea140fb353a4ab146691df9be5ad46be21ff
amazon-inspector
IN-MAL-2026-022182Versions from this source: 4.1.9
sha256: cf2b098c0145a47baf06fe081c4f9e28ce91cf2920950d23590f6c4f117842c2
amazon-inspector
IN-MAL-2026-022116Versions from this source: 4.0.57
sha256: d974034cdfef3f7bc43cd4faf7a153a8c5527bd56d5401dcfeee18b4438a48bd
amazon-inspector
IN-MAL-2026-022124Versions from this source: 4.0.56
sha256: 3ae0d7d01d6afaae966b6cbf761530c44d7155594bb13c7ae890eadb9f8fe4dd
amazon-inspector
IN-MAL-2026-022233Versions from this source: 4.1.19
sha256: 87fb5656dcf338932828d48081fd35939d8021b0427b1ccf8939b32dc2012be0
amazon-inspector
IN-MAL-2026-022181Versions from this source: 4.1.14
sha256: b0135fc94540220bc4dfe2f66120b3a5998ca3b900fac412f72db49de411381d
amazon-inspector
IN-MAL-2026-022109Versions from this source: 4.1.20
sha256: 0a8991af13903dc263c114d5a81eff7b88269b668ee5ebac44b7bbb99ebba235
ghsa-malware
GHSA-9855-prwc-mfp2Versions from this source: 4.1.2, 4.1.5, 4.1.20, 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18
sha256: 66b8f4fe53056761ae1d8afd61e0cb3af6464438a0374dbf80daaf92379db519
The OSSF `malicious-packages` namespace lists packages flagged as malicious by static analysis or sandbox detonation. An entry here is a confirmed finding, not a suspicion.
Metrics
—
Priority
No value is available for this vulnerability.
—
CVSS v3
No value is available for this vulnerability.
—
EPSS score
No value is available for this vulnerability.
Show all metrics
- Severity
- High
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 30.00 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- no public PoC known
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- —
- Published
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (ad4663af5b87079e1a7cdbfd6f3626801e542f7fdfe79316dec31974dd625941)
Package bundles a collection of skill directories containing various helper scripts. Static pattern matches fired on routine network primitives: a Python scraper (bundled-skills/junta-leiloeiros/scripts/base_scraper.py) and an API server script (serve_api.py) that reference ping/GET/POST, a benchmark harness (bundled-skills/loki-mode/benchmarks/run-benchmarks.sh), an rclone install helper (bundled-skills/rclone-cli/scripts/install.sh) that runs curl https://rclone.org to fetch the rclone installer from its official project domain, and a youtube-notetaker verification script using curl against GET endpoints. Matches reflect keyword co-occurrence (curl/ping/GET/POST) in utility scripts rather than exfiltration shapes: no hardcoded attacker C2, no reads of installer-side secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment scraping, no obfuscated destinations, and no install-time lifecycle hook that auto-executes these scripts. The rclone install.sh fetches from rclone's official domain, which is aggressive-but-legitimate runtime tool installation rather than a dropper. The scripts fire only when a user explicitly invokes the corresponding skill, not on npm install.
Source: ghsa-malware (c84dd18445ee7b0f29f3f76c81efb76a43fa7ef77d4c99b57245f4ef8e72a13a)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.