Unverified50% confidenceSolutionExact time
When investigating a backdoor, one can check authorized_keys for unfamiliar entries, check whether autostart entries point to unknown scripts, and audit recent SSH login logs.
1
Sources
50%
Confidence
Long-term
Relevance
10/30/2026
First Seen
Sources
Nearly 5,000 Affected! AI Coding Plugin Found with Backdoor, Officials Urgently Remove It
bilibiliToken家有吞金兽10/30/2026
Related Entities
Related Claims
UnverifiedIf you have opened a suspicious HTML file, you should rotate SSH key pairs and all cloud platform access keys, check for anomalous access, audit local file access records, and notify your security team.77% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果73% similarUnverifiedThe malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.68% similarUnverifiedIn 2023, multiple NPM packages were found to contain malicious code that automatically exfiltrated users' SSH keys and AWS credentials upon installation.67% similarUnverifiedA security scan found that a cloned repository's .npmrc could send the registry token out through its own proxy, and the proof of concept captured the Bearer USER-SECRET-TOKEN.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1118339API
curl https://kongchang.com/api/v1/knowledge/claims/1118339MCP
get_claim(id=1118339)