Hey,
I think we should be careful not to jump to conclusions about the developer. Maybe a compromised account, maybe something else, we don’t know yet and nobody confirmed.
What I do know is that 10.8.7 has a suspicious function that looks like a hardcoded backdoor. So I deleted the plugin entirely. Deactivation is not enough, the files stay on the server and the code can still be reached. I also checked my users list for rogue admins, refreshed my WordPress salts using the official generator to kill all sessions, and ran a Wordfence scan to catch anything hidden.
If you have a backup from before July 28, restoring it might be the safest route.
I won’t reinstall until the repo reopens and someone I trust confirms the next version is clean. The default WordPress embed block works fine for most videos in the meantime.
Stay safe.
yhdm
(@yellowhousedesign)
@yellowhousedesign thank you for sharing this ! 🙂
I did not take it down. Thankfully wp.org team did. Read this for some info about it.
The TLTR is, if you never got, and you most likely never did get 10.8.7 and 10.8.8 you are perfectly fine.
If you not manually downloaded it during that very small time window you are almost certainly fine. I have yet to verify if 3rd party distributions exist that distribute plugins from wp.org earlier then wp.org lifts their 24h cooldown period.
I am still dealing with the consequences of this … my plugins will hopefully be restored soon. Email to the wp.org team is already out. My account is already restored as you can see.
I was working in a new way to actually make the native embed block of WordPress get all the ARVE options and output in the editor, I found out how to do it this would be better than a separate ARVE block.
Hi @nico23 , thank you for your reply and your blog post. I’m glad to hear you didn’t get hacked. Anyway, good luck getting your plugin back on track. Take care.
@quentinldd Ähh I did get hacked. In fact I installed another new Linux distro on a different SSD to escape my old system that I can not trust anymore because this thing compromised it. Still need to figure out how I get my data back like tiny piece by piece doing everything from scratch to escape this thing. I can’t just bulk copy everything back over. I watched it try again after this happened and I was aware, I do not know if its was from my system or remote, does actually not matter. But if run my old system with all my binaries, scripts, tools, codium extensions … it will probably do this shit again. Most annoying thing to deal with. Need to look over everything.
What did you think?
Oh, I see! I thought the malware was just junk added by vibe coding, my bad ^^’ Anyway, I wish you the best of luck recovering everything, it sounds like a nightmare…
It may have been just that my Github CLI login token was stolen by a AI model or something else, I had activity from United Arab Emirates on my Github account. Does not even show state and city like it shows for me, only UAE. And I am from Germany. They activated a web-hook that somehow re-inject malware or connect to this fontswpDOTcom that was in the malware code. Now with a more clear head it looks more like a run-of-the-mill cheap php malware injection rather then some super elaborate super smart AI thing.
And the default auth mechanism for the Github CLI is absolutely ridiculously insecure, not sure if they change it now, probably now, not tried again the default way but a fine grained way now where my token does not have write access as I do not need it, but it seems the default is that it stores a free for all token on your disk without any password needed or anything that has complete control over your entire account.
Its possible that everything was done remotely after a secret was stolen, but I can not know for sure so I am on a new system and I use ai-jail now digitally lock in AI into a confined restricted space without access to all kinds of files.
Anyway, the plugin is finally back online and I am operating in a much more secure way now. Not that I was totally not careing, I way already using Linux where traditional viruses are basically not exist and operating way more securely that the average person but for this, all that did not help.
General advice from me would be, unrelated to this specifically. (Not saying I did not do almost all of these things)
- Pick security over convenience
- Use two factor auth (2FA)
- Rotate your logins every once in a while
- Check if some apps you use not has insecure and bad default like storing things on disk plainly without any encryption.
My brain hurts
