MalwarePublished 13 Jul 2026

@quukk/opencode-clawmessenger (npm) · Malicious Code

Affects @quukk/opencode-clawmessengerSource GCVE Database

Malicious package : remove @quukk/opencode-clawmessenger and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:51 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10495

What to do

Remove @quukk/opencode-clawmessenger from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@quukk/opencode-clawmessenger	Affected =1.1.10	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @quukk/opencode-clawmessenger version 1.1.10 contains malicious code that establishes a remote-controlled bridge. After user setup, it authenticates to a remote server and connects to a messaging channel to receive commands that can start, stop, restart, or control local processes. The package obfuscates its code to hide its behavior, disables TLS verification when fetching sensitive credentials, and replaces a system binary with a wrapper to maintain control. This allows an attacker controlling the remote relay or messaging account to execute arbitrary commands on the user's machine after setup.

Impact

An attacker controlling the remote relay server or the bound RongCloud IM account can remotely execute device control commands on the victim's machine, including starting, stopping, restarting, and reloading processes. The package's obfuscation and disabled TLS verification increase the difficulty of detection and allow credential interception. The replacement of the system binary with a malicious wrapper ensures persistent control over the OpenCode environment. This results in a significant compromise of the victim's system integrity and confidentiality after the user runs the setup command.

Defensive guidance

Users should avoid running the 'setup' subcommand of this package and uninstall version 1.1.10 if installed. Since the malicious behavior is gated behind user invocation of 'setup', refraining from this action prevents activation. Monitor for and remove any instances of the wrapper replacing the 'opencode' binary. Check vendor advisories or trusted security sources for updates or fixes.

Summary

The @quukk/opencode-clawmessenger npm package (version 1.1.10) acts as a remote-controlled bridge once the user runs the 'setup' subcommand. It authenticates to https://newsradar.dreamdt.cn/im and connects to a RongCloud IM channel, processing inbound device control commands such as start, stop, restart, status, and reload. The package forwards chat content to a local OpenCode AI session and returns responses over the IM channel. The entire dist/ directory and wrapper script are heavily obfuscated, hiding message handlers. The package fetches the RongCloud appSecret with TLS verification disabled, enabling man-in-the-middle interception and injection of attacker-controlled secrets. During setup, it renames the system 'opencode' binary and replaces it with a wrapper to route future invocations through this malicious bridge. This combination enables remote third-party control of the local OpenCode environment after setup completion.

References

npmjs.com/package/@quukk/opencode-clawmessenger/v/1.1.10 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:51 UTC

Technical details

References

Community reviews