Malicious code in @cherrydotfun/miniapp-sdk versions 0.1.22 and 0.1.23

critical severity · published 2026-11-06

Any computer with this package installed should be treated as fully compromised, and an outside attacker may have full control. Removing the package does not guarantee that all malicious software is gone.

Source: OSV

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 826 and your operating system.