Check a package, MCP config or SKILL.md

package opencode-skills-collection

Block

Reported malicious in threat research: every version of this package should be treated as harmful. Do not install.

Latest version: 4.1.30
First published: 7 months ago
Maintainers: 1
Catalog grade: Not in the AI-tool catalog
Est. context load: ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)

Threat reports

MaliciousMalicious code in opencode-skills-collection (npm) Affected versions: 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18, 4.1.20, 4.1.2, 4.1.5
MaliciousMalware in opencode-skills-collection Affected versions: 4.1.18, 4.1.9, 4.0.77, 4.1.0, 4.0.56, 4.1.12, 4.1.19, 4.1.14, 4.1.17, 4.1.7, 4.1.8, 4.1.1, 4.1.4, 4.1.3, 4.1.6, 4.1.13, 4.1.16, 4.1.11, 4.0.57, 4.1.10, 4.1.20, 4.1.5, 4.1.2

If it is already installed, remove it:

# DO NOT INSTALL opencode-skills-collection — remove immediately if present:
npm uninstall opencode-skills-collection

Threat reports checked Oct 30, 2026. Our opinion, not a code audit or security guarantee. Answers change through the day.

Go deeper

The answer above comes from threat reports and registry facts. A free first look also analyzes this version’s published files and shows the grade and how many serious issues we found. The full report adds the evidence, what it can access and what it does at install: $19 once, or 3 a month on Pro.