published 2026-10-05
The hidden payload in version 5.8.3 starts during installation or import and steals credentials, and it gives the attacker remote shell access to the machine. It targets developer workstations and CI environments, including GitHub Actions runners and reachable cloud services.
Source: stepsecurity.io
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1767 and your operating system.