Repository navigation
Security Release
This release replaces v6.2.0, which was not published by the maintainer. On October 11, 2026, an attacker used a leaked GitHub token to publish a malicious v6.2.0 build that collected credentials, browser data and crypto wallets. It was available from 2026-10-11 20:35 UTC until about 2026-10-12 00:05 UTC.
v6.2.1 is built from the restored code and contains no other changes since v6.1.0. If you are on v6.2.0, updating to this version removes the malicious build.
If you ran v6.2.0, treat every secret on that machine as compromised: rotate SSH keys, GitHub, npm and cloud tokens and saved browser passwords, and move funds from any crypto wallet on that machine. You can check whether the malware ran by looking for the .runtime file in the massCode data folder. Details and instructions: #978.
v6.1.0 and earlier are not affected.
Full Changelog: v6.1.0...v6.2.1