docs(security): add analysis of malicious kilocode-agent/kilocode-2.0 repo

[kilo-code-bot]

Summary

Adds a security analysis report for the GitHub repository kilocode-agent/kilocode-2.0, which impersonates Kilocode to distribute an opaque, pre-compiled Windows binary via GitHub Releases. The source code in the repo is stolen from the OpenCode desktop app (by Anomaly/SST) and serves as a decoy — it contains no malware itself, but the 89 MB .7z release binary has no verifiable build pipeline and cannot have been produced from the repo's source. The report documents all findings from a remote-only inspection of every file using the GitHub API.

Verification

• All 27 source files in the repo were fetched and decoded via gh api /repos/kilocode-agent/kilocode-2.0/contents/{path} --jq '.content' | base64 -d
• Full recursive file tree confirmed via gh api /repos/kilocode-agent/kilocode-2.0/git/trees/main?recursive=1
• Release assets, commit history, org metadata, and author profile inspected via GitHub API
• No code from the target repo was cloned or executed

Visual Changes

N/A

Reviewer Notes

The threat is the pre-compiled binary in Releases, not the source code. The source is legitimate OpenCode code used as social-engineering cover. Key red flags: no package.json, no CI/CD, org created same day as repo, SEO-optimized topics targeting "kilocode" searches, commit history showing deleted files. Recommend reporting the repo and org to GitHub.

[kilo-code-bot]

WARNING: This claim goes beyond the evidence in the report

The report establishes that files were added and later removed, but it does not show that the deleted directory contained malware or that the author was "cleaning up evidence". Presenting that as likely fact weakens the rest of the analysis and creates avoidable credibility risk.

Suggested change

	The "Delete core directory" commit suggests files were added and then removed — possibly experimental malware code that was cleaned up before the final push.
	The "Delete core directory" commit shows files were added and later removed, which is suspicious but not enough on its own to determine what those deleted files contained.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

WARNING

File	Line	Issue
SECURITY-REPORT-kilocode-2.0.md	53	The report speculates that deleted files were malware evidence without showing supporting proof.

Other Observations (not in diff)

None.

Files Reviewed (1 files)

• SECURITY-REPORT-kilocode-2.0.md - 1 issue

---

_{Reviewed by gpt-5.4-20260305 · 76,300 tokens}