CLAIM-2026-09-29-04
In the week of 17-23 September 2026, Datadog measured more than 647,000 weekly downloads of vulnerable OpenCode versions, which it puts at 38.9% of all OpenCode downloads in that period.
Why it matters
A month after a fix shipped, nearly two in five downloads still took the vulnerable code. Availability of a patch is not adoption of a patch.
Sources
- datadogsecu2026discoveri