Security incident: massCode v6.2.0 contained malware, do not install it #978

Summary

On October 11, 2026, an attacker used a leaked GitHub token belonging to the maintainer to publish a malicious massCode v6.2.0 release. It was built by the regular release pipeline and offered through the in-app auto-updater.

Affected: v6.2.0 only, on macOS, Windows and Linux, available from 2026-10-11 20:35 UTC until about 2026-10-12 00:05 UTC.
Not affected: v6.1.0 and earlier, and v6.2.1.

The malicious release has been withdrawn, the token revoked, the repository history restored, and branch, tag and CI secret protections enabled. v6.2.1 is a clean release built from the restored code: if you are on v6.2.0, the auto-updater will replace it.

What the malware does

About 1 to 2 minutes after launch, the malicious build collects and uploads: SSH keys, cloud and developer credentials (~/.aws, ~/.npmrc, GitHub CLI tokens, .env files), browser data and saved logins, the macOS Keychain, crypto wallets, and data of VS Code, Cursor and Claude.

Check if you are affected

If this file exists, the malware ran on your machine:

• macOS: ~/Library/Application Support/massCode/.runtime
• Windows: %APPDATA%\massCode\.runtime
• Linux: ~/.config/massCode/.runtime

What to do if you ran v6.2.0

1. Update to v6.2.1 (the app will offer it, or download it from Releases).
2. Treat every secret on that machine as compromised. Rotate SSH keys, GitHub, npm and cloud tokens, and passwords saved in your browsers. Sign out of active sessions.
3. Move funds from any crypto wallet that was on that machine to a new wallet.

Indicators of compromise

• File .runtime in the massCode data folder
• Connections to 191.217.250.119:443
• Related infrastructure: 91.107.208.233

Full technical details: GHSA-347q-f3qv-xq9w

I am sorry this happened. If you have questions, reply here.