Victim of the n2ns/antigravity-panel malware. blocked for 2 days. How do you measure your quota?

Google Antigravity
1

Did you guys know about this? Didnt know i had it. How do you guys measure your quota?

1 Like
2

here is a reddit post about it: https://www.reddit.com/r/google_antigravity/comments/1qvra7y/be_aware_of_security_issues_with_extensions_like/?chainedPosts=t3_1qu3xfx

1 Like
🚨 [MAJOR ALARM] "Google AI Pro" Paid Users being Locked out for 167 HOURS (7 Days)! This is UNACCEPTABLE
3

and do this. There was indeed somebody on my account.

1. Revoke the Token in Google Cloud

Since the article explains that the extension impersonates the official Google Antigravity application using the broad cloud-platform scope, you need to remove the authorization from your Google Account settings:

  • Go to your Google Account Security page:https://myaccount.google.com/permissions.

  • Look for an entry named “Google Antigravity” or “Antigravity”.

  • Select it and click Remove Access.

    • Note: Because the extension uses the official Client ID, it will appear as the legitimate application. Revoking this will sign you out of the actual Antigravity editor as well, but this is necessary to ensure the extension’s refresh token is invalidated.

2. Verify Google Cloud Console (IAM)

Because the extension requested the cloud-platform scope, it had access to your Google Cloud projects. To be safe:

  • Go to theGCP Console IAM page.

  • Ensure no unfamiliar service accounts or members were added to your projects.

3. Clear Local Plaintext Credentials

The article highlights that the extension leaves a plaintext file in your home directory that contains your Access and Refresh tokens. Simply uninstalling the extension does not delete this file.

  • On Windows: 1. Open File Explorer and go to %USERPROFILE% (usually C:\Users\YourName). 2. Look for a folder named .antigravity_cockpit. 3. Delete the entire folder and the credentials.json file inside.

  • On macOS/Linux:

    1. Open Terminal.

    2. Run: rm -rf ~/.antigravity_cockpit

4. Restart your Editor

Once you have revoked the token online and deleted the local files, restart your Antigravity (VS Code fork) editor. You will be prompted to log in again. This will generate a brand new, clean OAuth token that the deleted extension no longer has access to.

1 Like
4

:warning: There’s some confusion here. The issue isn’t with the extension the OP mentioned, but with another one! Read the Reddit post carefully.

:cross_mark:The extension which is reportedly unsafe, is called Antigravity Cockpit:

open-vsx..org/extension/jlcodes/antigravity-cockpit

:white_check_mark: The extension that was mentioned is actually safe to use, it’s called Tookit for Antigravity:

open-vsx..org/ extension/n2ns/antigravity-panel

5

yeah you are right. I should have mention that.

6

I also encountered this problem. Currently, my Claude quota refresh time is 148 hours. May I ask if following these steps will update the Claude quota in my Antigravity to 4 hours? Thank you.

image
image721×448 8.28 KB

7

no it dont. you have to sit it out. With me it was 2 days but i am on ultra. You can mail them and hope they will remove it. Did you remove all?

8

Thank you for your explanation. I followed the steps mentioned above two days ago, and the credit limit has been restored this morning. Mine is a Pro subscription.

1 Like