ACT NOWCompromised package
npm / opencode-skills-collection
Malicious code in opencode-skills-collection (npm)
What's happening and what to do
Malicious code was published inside this npm package, so anyone who installs it can have their system run attacker-controlled code. npm package opencode-skills-collection, including versions 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, and about 23 other versions. Remove opencode-skills-collection from all projects, pin away from every listed version, and check for signs of compromise on any system that installed it.
AI summary of the sources on this page. Regenerated when a source changes.
Affected versions
| Ecosystem | Package | Affected | Safe from |
|---|---|---|---|
| npm | opencode-skills-collection | 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18, 4.1.20, 4.1.2, 4.1.5, 4.1.31, 4.1.32, 4.1.30, 4.1.33, 4.1.22, 4.1.29 | None. Remove it. |
Signals over time
- 2026-11-03 22:10First seen here.