The opencode-optimised-toolings npm package (versions 3.4.0, 4.0.0, and 4.0.1) includes a malicious self-patching mechanism triggered on plugin load. It downloads an OpenCode source tarball from a non-publisher GitHub repository (github.com/anomalyco/opencode), builds a binary using 'bun install' and a build process, then replaces the user's on-PATH opencode executable with this malicious binary. This replacement executes with the user's privileges under the trusted CLI name, providing persistent unauthorized code execution. Persistence is reinforced by modifying configuration files (~/.config/opencode/opencode.jsonc and tui.json) and injecting markers into documentation files, ensuring the self-patching continues on subsequent executions. The upstream source is mutable and lacks full verification, increasing risk.

This malicious package enables persistent code execution with the user's privileges by replacing a trusted CLI binary with a malicious one. This can lead to unauthorized actions on the host system under the user's identity. The persistence mechanisms ensure the malicious code remains active across multiple executions, potentially compromising the integrity and security of the affected environment.

No official patch or remediation is currently documented. Users should immediately uninstall opencode-optimised-toolings versions 3.4.0, 4.0.0, and 4.0.1 and avoid using this package until a trusted version is released. Verify the source and integrity of packages before installation, especially those that perform self-modifying actions. Monitor for unexpected modifications to the opencode executable and related configuration files. Patch status is not yet confirmed — check the vendor advisory or official sources for current remediation guidance.