The way some of this place's employees post and act online, can't say I feel all that bad.
https://docs.github.com/en/code-security/reference/secret-se... has a table with the active partners
that's why virustotal was flagging it then
In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.
https://dev.opencode.ai/console/
It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI
From https://opencode.ai/v2/docs#connect :
> If you’d like easy access to all the best coding models you can try out OpenCode Console.
I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?
> related to a large scale distillation attack
I'm not sure how this adds up. I could understand if this impacted their uptime, but not security.
Are they actually saying a bunch of credentials were stolen and are being used for distillation?
---
Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.
We’re sorry this happened and will follow up with any updates.
Me, 68 days ago:
> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.