Comment by oldfuture

6 hours ago

https://news.ycombinator.com/item?id=50108261

that's why virustotal was flagging it then

It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.

  • They have multiple online platforms, reading other comments, this looms to be the BYOK system where you upload keys to other vendors, as compared to Go, where you can generate API keys for your $10 sub