{"id":"MAL-2026-18193","url":"https://compromised.live/t/MAL-2026-18193","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in opencode-skills-collection (npm)","summary":"Malicious code was published inside this npm package, so anyone who installs it can have their system run attacker-controlled code. npm package opencode-skills-collection, including versions 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, and about 23 other versions. Remove opencode-skills-collection from all projects, pin away from every listed version, and check for signs of compromise on any system that installed it.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"opencode-skills-collection","affected":"4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18, 4.1.20, 4.1.2, 4.1.5, 4.1.31, 4.1.32, 4.1.30, 4.1.33, 4.1.22, 4.1.29","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-03T22:10:45.281Z","status":"active","details":"","aliases":["GHSA-9855-prwc-mfp2","MAL-2026-18193"],"sources":[{"name":"osv","id":"MAL-2026-18193","url":"https://osv.dev/vulnerability/MAL-2026-18193"}]}