Pidgin discovered a malicious plugin named ss-otr containing a keylogger and sharing unauthorized screenshots. Added on July 6th, it was reported on August 16th and confirmed as malicious by August 22nd. Users should uninstall it immediately. Pidgin will now require plugins to have an OSI Approved Open Source License and undergo safety checks.
https://alternativeto.net/news/2024/8/pidgin-removes-malicious-plugin-containing-keylogger-and-sharing-screenshots/