Unverified50% confidenceFactExact time
The malicious extension collects hostnames, usernames, system architecture and public IP addresses, and writes the attacker's email into the authorization file to establish a reverse-tunnel backdoor.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/31/2026
First Seen
Valid until: 11/14/2026
Sources
OpenCode Gives Away $100 DeepSeek Credits: Subscription Arbitrage and Security Alerts Run Rampant
bilibili小心鸦Xxya10/31/2026
Related Entities
Related Claims
UnverifiedThe malicious code collects hostname, username, OS type, Gate email, public IP and other information and sends it out.76% similarVerifiedIndirect injection refers to attackers hiding malicious instructions in external content that the model will read, such as webpage body text, email body text, or document content.73% similarUnverifiedOnce an attacker gains access to the Monorepo repository, they can often simultaneously access source code across multiple product lines, embedded API keys and service account credentials, CI/CD pipeline configurations, and infrastructure-as-code files72% similarVerifiedCredential stuffing attacks refer to attackers automatically attempting to use username-password combinations leaked from one breach to log in to other websites in order to take over accounts.72% similarUnverifiedThe attack entry point was a malicious dataset that exploited two code execution paths: a remote code dataset loader and a configuration template injection.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1119836API
curl https://kongchang.com/api/v1/knowledge/claims/1119836MCP
get_claim(id=1119836)