critical severity · published 2026-11-09
Any computer with this package installed is fully compromised. An attacker gains access to every secret and key stored on the machine, so all credentials must be rotated from a different computer.
Source: @step_security on X
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1907 and your operating system.