Which versions of @quukk/opencode-clawmessenger are malicious?

The following npm versions of @quukk/opencode-clawmessenger are flagged malicious: 1.1.10. Treat any of these as compromised.

How do I remediate @quukk/opencode-clawmessenger if I installed it?

@quukk/opencode-clawmessenger is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @quukk/opencode-clawmessenger — how do I know if it already compromised me?

If @quukk/opencode-clawmessenger was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @quukk/opencode-clawmessenger part of a known attack campaign?

Yes — @quukk/opencode-clawmessenger is associated with the IN-MAL-2026-010323 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @quukk/opencode-clawmessenger across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @quukk/opencode-clawmessenger (version 1.1.10). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @quukk/opencode-clawmessenger across your stack and pipelines.

Malicious package

@quukk/opencode-clawmessengernpm

Malicious code in @quukk/opencode-clawmessenger (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10495

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @quukk/opencode-clawmessenger

What this malware does

The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticates to https://newsradar.dreamdt.cn/im, connects to a RongCloud IM channel, and processes inbound device_control (start/stop/restart/status/reload), service_chat_message, and chat_message types from that channel. Chat content is forwarded to a local OpenCode AI session at http://127.0.0.1:19877 and responses are returned over IM (dist/core/message-handler.js: case RongyunMessageTypeEnum[...DEVICE_CONTROL...]: await this['handleDeviceControl'](...) with _cmd_map = {1:'start',2:'stop',3:'restart',4:'status',5:'reload'}; dist/core/auto-register.js: DEFAULT_SERVER_URL='https://newsradar.dreamdt.cn/im'). Whoever controls the dreamdt.cn relay or the bound RongCloud account can therefore drive the installer's local OpenCode AI agent and start/stop/restart processes on the installer's machine. Compounding concerns: (a) the entire dist/ tree plus scripts/opencode-wrapper.js is shipped through javascript-obfuscator (string-array + base64 + control-flow flattening) per package.json's prepublishOnly: npm run build && npm run obfuscate, hiding the full set of message handlers from review; (b) getAppSecret() in dist/core/auto-register.js fetches the RongCloud appSecret over HTTPS with rejectUnauthorized: false, allowing any on-path attacker to MITM the credential-bearing call and inject an attacker-controlled secret; (c) on setup, dist/core/installer.js renames the system opencode binary to opencode-original.* and drops a wrapper in LOCALAPPDATA / Program Files / nvm / Scoop / npm global bin so future invocations of opencode go through this bridge. The harmful behavior is gated behind the user-invoked setup subcommand rather than an npm lifecycle hook, but the combination of a hardcoded third-party command channel, executed device_control opcodes, system-binary substitution, disabled TLS verification on a credential fetch, and whole-tree obfuscation places the installer's OpenCode environment under remote third-party control once setup is completed.

Malicious versions

1 flagged

1.1.10

Indicators of compromise (SHA-256)

74e48f1438950e47277df7d6b0df77f7e2ecf2315323b0012a293299bbb91b9c

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @quukk/opencode-clawmessenger (version 1.1.10). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @quukk/opencode-clawmessenger across your stack and pipelines.
If you installed it — respond
@quukk/opencode-clawmessenger is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @quukk/opencode-clawmessenger was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @quukk/opencode-clawmessenger before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @quukk/opencode-clawmessenger on npm has been identified as a malicious package (version 1.1.10 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010323

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @quukk/opencode-clawmessenger-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring