{"answers":{"affected":"1 open source package ship an affected version, including @quukk/opencode-clawmessenger.","exploited":"There is no known exploitation of MAL-2026-10495 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10495 is a malicious package in @quukk/opencode-clawmessenger, published on 13 Jul 2026."},"fix_prompt":"MAL-2026-10495 is a malicious package: @quukk/opencode-clawmessenger (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10495/ (Markdown: https://insights.sbomify.com/MAL-2026-10495/index.md)","id":"MAL-2026-10495","markdown":"https://insights.sbomify.com/MAL-2026-10495/index.md","name":"MAL-2026-10495","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package is a remote-controlled bridge: after the user runs `opencode-clawmessenger setup` and binds via QR code, the installed wrapper authenticates to https://newsradar.dreamdt.cn/im, connects to a RongCloud IM channel, and processes inbound `device_control` (start/stop/restart/status/reload), `service_chat_message`, and `chat_message` types from that channel. Chat content is forwarded to a local OpenCode AI session at http://127.0.0.1:19877 and responses are returned over IM (dist/core/message-handler.js: `case RongyunMessageTypeEnum[...DEVICE_CONTROL...]: await this['handleDeviceControl'](...)` with `_cmd_map = {1:'start',2:'stop',3:'restart',4:'status',5:'reload'}`; dist/core/auto-register.js: `DEFAULT_SERVER_URL='https://newsradar.dreamdt.cn/im'`). Whoever controls the dreamdt.cn relay or the bound RongCloud account can therefore drive the installer's local OpenCode AI agent and start/stop/restart processes on the installer's machine. Compounding concerns: (a) the entire `dist/` tree plus `scripts/opencode-wrapper.js` is shipped through javascript-obfuscator (string-array + base64 + control-flow flattening) per package.json's `prepublishOnly: npm run build \u0026\u0026 npm run obfuscate`, hiding the full set of message handlers from review; (b) `getAppSecret()` in dist/core/auto-register.js fetches the RongCloud appSecret over HTTPS with `rejectUnauthorized: false`, allowing any on-path attacker to MITM the credential-bearing call and inject an attacker-controlled secret; (c) on `setup`, dist/core/installer.js renames the system `opencode` binary to `opencode-original.*` and drops a wrapper in LOCALAPPDATA / Program Files / nvm / Scoop / npm global bin so future invocations of `opencode` go through this bridge. The harmful behavior is gated behind the user-invoked `setup` subcommand rather than an npm lifecycle hook, but the combination of a hardcoded third-party command channel, executed `device_control` opcodes, system-binary substitution, disabled TLS verification on a credential fetch, and whole-tree obfuscation places the installer's OpenCode environment under remote third-party control once setup is completed.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @quukk/opencode-clawmessenger (npm)","id":"MAL-2026-10495","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@quukk/opencode-clawmessenger","purl":"pkg:npm/%40quukk/opencode-clawmessenger","source":"MAL-2026-10495"}],"products":null,"published":"2026-07-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10495/"}