Malicious code in @quukk/opencode-clawmessenger (npm)
The npm package @quukk/opencode-clawmessenger version 1.1.10 contains malicious code that establishes a remote-controlled bridge. After user setup, it authenticates to a remote server and connects to a messaging channel to receive commands that can start, stop, restart, or control local processes. The package obfuscates its code to hide its behavior, disables TLS verification when fetching sensitive credentials, and replaces a system binary with a wrapper to maintain control. This allows an attacker controlling the remote relay or messaging account to execute arbitrary commands on the user's machine after setup.
AI Analysis
Technical Summary
The @quukk/opencode-clawmessenger npm package (version 1.1.10) acts as a remote-controlled bridge once the user runs the 'setup' subcommand. It authenticates to https://newsradar.dreamdt.cn/im and connects to a RongCloud IM channel, processing inbound device control commands such as start, stop, restart, status, and reload. The package forwards chat content to a local OpenCode AI session and returns responses over the IM channel. The entire dist/ directory and wrapper script are heavily obfuscated, hiding message handlers. The package fetches the RongCloud appSecret with TLS verification disabled, enabling man-in-the-middle interception and injection of attacker-controlled secrets. During setup, it renames the system 'opencode' binary and replaces it with a wrapper to route future invocations through this malicious bridge. This combination enables remote third-party control of the local OpenCode environment after setup completion.
Potential Impact
An attacker controlling the remote relay server or the bound RongCloud IM account can remotely execute device control commands on the victim's machine, including starting, stopping, restarting, and reloading processes. The package's obfuscation and disabled TLS verification increase the difficulty of detection and allow credential interception. The replacement of the system binary with a malicious wrapper ensures persistent control over the OpenCode environment. This results in a significant compromise of the victim's system integrity and confidentiality after the user runs the setup command.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid running the 'setup' subcommand of this package and uninstall version 1.1.10 if installed. Since the malicious behavior is gated behind user invocation of 'setup', refraining from this action prevents activation. Monitor for and remove any instances of the wrapper replacing the 'opencode' binary. Check vendor advisories or trusted security sources for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in @quukk/opencode-clawmessenger (npm)
Description
The npm package @quukk/opencode-clawmessenger version 1.1.10 contains malicious code that establishes a remote-controlled bridge. After user setup, it authenticates to a remote server and connects to a messaging channel to receive commands that can start, stop, restart, or control local processes. The package obfuscates its code to hide its behavior, disables TLS verification when fetching sensitive credentials, and replaces a system binary with a wrapper to maintain control. This allows an attacker controlling the remote relay or messaging account to execute arbitrary commands on the user's machine after setup.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @quukk/opencode-clawmessenger npm package (version 1.1.10) acts as a remote-controlled bridge once the user runs the 'setup' subcommand. It authenticates to https://newsradar.dreamdt.cn/im and connects to a RongCloud IM channel, processing inbound device control commands such as start, stop, restart, status, and reload. The package forwards chat content to a local OpenCode AI session and returns responses over the IM channel. The entire dist/ directory and wrapper script are heavily obfuscated, hiding message handlers. The package fetches the RongCloud appSecret with TLS verification disabled, enabling man-in-the-middle interception and injection of attacker-controlled secrets. During setup, it renames the system 'opencode' binary and replaces it with a wrapper to route future invocations through this malicious bridge. This combination enables remote third-party control of the local OpenCode environment after setup completion.
Potential Impact
An attacker controlling the remote relay server or the bound RongCloud IM account can remotely execute device control commands on the victim's machine, including starting, stopping, restarting, and reloading processes. The package's obfuscation and disabled TLS verification increase the difficulty of detection and allow credential interception. The replacement of the system binary with a malicious wrapper ensures persistent control over the OpenCode environment. This results in a significant compromise of the victim's system integrity and confidentiality after the user runs the setup command.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid running the 'setup' subcommand of this package and uninstall version 1.1.10 if installed. Since the malicious behavior is gated behind user invocation of 'setup', refraining from this action prevents activation. Monitor for and remove any instances of the wrapper replacing the 'opencode' binary. Check vendor advisories or trusted security sources for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10495
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff9968715ace432f6248
Added to database: 07/14/2026, 09:21:29 UTC
Last enriched: 07/14/2026, 09:51:25 UTC
Last updated: 07/28/2026, 06:54:34 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.