Anyone with an OpenCode account should treat credentials tied to it as exposed until the project says otherwise. A forum headline says OpenCode was hacked and that user credentials leaked, and it links to a post on the project's X account.
That is nearly all the source material contains. The forum link drew 287 points and 57 comments, which shows how closely developers are watching, not that any detail has been confirmed. The material does not include the text of the linked post, so this article does not describe what it says about scope, timing, or cause.
The gaps matter. "Credentials" could mean passwords, API keys (the secret strings that let software call a paid service), or login tokens. Each calls for a different response, and none is specified. Neither the number of affected users nor the way attackers got in appears in the source.
Still, the sensible precautions do not depend on those answers. Change any password you reused elsewhere, and rotate any keys you gave the tool, particularly keys for AI model providers, since a stolen key can run up someone else's bill. Developer tools tend to hold secrets that open other doors. When CircleCI, a software build service, disclosed a breach in 2023, its advice was to rotate every secret stored on the platform, not just the CircleCI login.
The detail that will decide how serious this is has not surfaced: whether the leaked credentials were stored hashed (scrambled so they cannot be read back) or in a form an attacker could use directly.