published 2026-10-31
The extension opened a reverse SSH tunnel on the machine, giving the attacker remote access to it. They could read files and secrets stored locally, including tokens, API keys and SSH keys.
Source: @PatchOnChain on X
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2360 and your operating system.