published 2026-11-09
Installing strutil-core version 1.0.1 runs a credential-stealing worm that takes secrets from the machine. It also plants persistence in AI coding agent configs so it keeps running after install.
Source: @_josehelps on X
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2307 and your operating system.