It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.