AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by Malicious code in opencode-skills-collection (npm)? What should I do?

    The npm package opencode-skills-collection contains malicious code.

    Affected: opencode-skills-collection (npm) 4.0.56, 4.0.57, 4.0.77, 4.1.0, 4.1.1, 4.1.3, 4.1.4, 4.1.6 to 4.1.14, 4.1.16 to 4.1.20. Fixed in: no fix reported yet. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/mal-2026-18193-opencode-skills-collection (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: opencode-skills-collection (npm) 4.0.56, 4.0.57, 4.0.77, 4.1.0, 4.1.1, 4.1.3, 4.1.4, 4.1.6 to 4.1.14, 4.1.16 to 4.1.20. Fixed in: no fix reported yet.

      • Check your version: run npm ls opencode-skills-collection. Versions 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18, 4.1.20 of opencode-skills-collection are affected.

      What to do now

      1. Remove the package if it is installed: run npm uninstall opencode-skills-collection.
      2. Rotate all secrets and keys stored on that computer right away, doing it from a different computer.
      3. Remove the package from the computer.
      4. Know that removing the package may not remove all the malicious software that came from installing it.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/mal-2026-18193-opencode-skills-collection (opens external site)

      Did this work for you?

    Add your answer or comment