MalwarePublished 22 Oct 2026Updated 29 Oct 2026

opencode-skills-collection (npm) · Malicious Code

Affects opencode-skills-collectionSource GCVE Database

Malicious package : remove opencode-skills-collection and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 19:00 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18193

What to do

Remove opencode-skills-collection from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmopencode-skills-collection	Affected 4.0.56 – 4.1.20 23 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The opencode-skills-collection npm package contains multiple utility scripts that perform network operations such as curl, ping, GET, and POST requests. These scripts do not automatically execute during installation and do not contain hardcoded attacker command and control servers or environment scraping. However, the package is flagged as malicious by GHSA malware sources, indicating that any system with this package installed should be considered fully compromised, and all secrets and keys should be rotated. Removal of the package alone may not eliminate all malicious software.

Impact

Systems with the opencode-skills-collection package installed are considered fully compromised, implying potential unauthorized access or control by attackers. All secrets and keys stored on the affected systems should be rotated immediately. Removal of the package does not guarantee complete remediation due to possible persistence of malicious software installed alongside or as a result of this package.

Defensive guidance

Remove the opencode-skills-collection package immediately from affected systems. Rotate all secrets, keys, and credentials from a separate, trusted computer to prevent further compromise. Conduct a thorough security assessment and remediation of the affected systems, as removal of the package alone may not eliminate all malicious components.

Summary

The opencode-skills-collection npm package bundles various helper scripts that perform network-related tasks, including a Python scraper, an API server script, a benchmark harness, an rclone installer helper, and a YouTube notetaker verification script. These scripts use legitimate network commands and fetch resources from official domains without obfuscation or automatic execution during npm install. Despite the lack of direct evidence of exfiltration or command and control infrastructure, the package is classified as malware by GHSA, warning that any computer with this package installed is fully compromised and requires immediate secret rotation and package removal. The package's malicious nature is inferred from the GHSA advisory rather than direct technical indicators in the scripts.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:22 UTC

Technical details

References

Community reviews