MalwarePublished 5 Aug 2026

opencode-engos-ai (npm) · Malicious Code

Affects opencode-engos-aiSource GCVE Database

Malicious package : remove opencode-engos-ai and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 18:46 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12405

What to do

Remove opencode-engos-ai from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmopencode-engos-ai	Affected 1.20.3 – 1.20.6 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274) On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<arch>[-baseline][-musl], resolves each to the current 'latest' tag via `npm view <name> version`, installs the resolved version into a temp directory, then copies the fetched 'opencode' binary into the wrapper's bin/ with chmod 755. The fetched artifact is not pinned to a specific version and is not hash- or signature-verified, so whatever the publisher of the sibling packages pushes to 'latest' at install time is what executes on the installer's host. The sibling package names are not declared in the manifest's optionalDependencies, so they are resolved by name rather than through the reviewable dependency graph. In addition, createSymlinks() writes symlinks at /usr/local/bin/innexarcode and /usr/bin/innexarcode pointing at the fetched binary — a name that matches neither the package name (opencode-engos-ai), its declared bin entry (opencode-engos), nor any documented CLI, placing an unrelated command into the installer's system PATH. The package name also resembles the existing 'opencode' AI CLI.

Impact

Because the package fetches and executes unpinned, unverified binaries from sibling packages at install time, an attacker controlling those sibling packages can execute arbitrary code on the host system during installation. The creation of symlinks with unrelated command names in system PATH further increases the risk of stealthy execution and user confusion. This can lead to system compromise or persistence of malicious code.

Defensive guidance

Users should avoid installing affected versions (=1.20.3, =1.20.4, =1.20.5, =1.20.6) of opencode-engos-ai. Verify package integrity and avoid packages that dynamically fetch unpinned dependencies or create unexpected system-wide symlinks. Monitor vendor advisories for updates or fixes addressing this issue.

Summary

The opencode-engos-ai npm package, specifically versions 1.20.3, 1.20.4, 1.20.5, and 1.20.6, includes a post-install script that dynamically fetches and installs platform-specific sibling packages by resolving their 'latest' versions without pinning or verifying integrity. This allows the publisher of those sibling packages to push arbitrary code that will be executed on the installer's host. Additionally, the package creates symlinks named 'innexarcode' in system PATH locations (/usr/local/bin and /usr/bin) pointing to the fetched binary, which is unrelated to the package name or declared CLI commands, potentially misleading users and enabling stealthy execution of malicious code.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:04 UTC

Technical details

References

Community reviews