Gonna take a bit. The dudes been doing the releases for over a year, everything they touched is suspect now even if nothing earlier is known. Also some other associated accounts have been doing shady stuff too.
And that’s just one project that had a burnt out maintainer who welcomed some help from this guy. There are probably others. The hobby project becoming a core piece is a big issue.
Gonna take a bit. The dudes been doing the releases for over a year, everything they touched is suspect now even if nothing earlier is known. Also some other associated accounts have been doing shady stuff too.
gonna take even a bit more now. Github closed the account and project making it really difficult to see their commits and merges and analyze them.
Supply chain attacks are extremely cheap/easy and very effective, so get prepared for more of them in the future.
It really bothers me, that many companies make billions utilizing open source without contributing money/employees etc. to secure/supply/maintain supply chains.
Agreed. I am more speaking of 'in general', for example there was a supply chain attack on a widely used npm package by writing an email to the author of the npm package. There are other 'cheap' attacks like dependency confusion, typo squatting etc.
17 Comments
thurstylark@lemm.ee · 41 pts · 2y
Me: fixes exposure to vuln
Also me: grabs popcorn
This is going to be an interesting story once this all quiets down...
Bitrot@lemmy.sdf.org · 48 pts · 2y
Gonna take a bit. The dudes been doing the releases for over a year, everything they touched is suspect now even if nothing earlier is known. Also some other associated accounts have been doing shady stuff too.
And that’s just one project that had a burnt out maintainer who welcomed some help from this guy. There are probably others. The hobby project becoming a core piece is a big issue.
SuperIce@lemmy.world · 20 pts · 2y
Yeah, it looks like that little Jenga block from the xkcd meme was XZ and a bunch of infrastructure is gonna have issues because of it.
brunacho@scribe.disroot.org · 10 pts · 2y
gonna take even a bit more now. Github closed the account and project making it really difficult to see their commits and merges and analyze them.
Bitrot@lemmy.sdf.org · 6 pts · 2y
It’s also at https://git.tukaani.org.
theshatterstone54@feddit.uk · 5 pts · 2y
It says F39 users are not affected. Are you running Rawhide/F40 Beta? p
thurstylark@lemm.ee · 10 pts · 2y
Running Arch, so not really exposed, but still had a compromised version installed.
wolf@lemmy.zip · 26 pts · 2y
Mandatory XKCD: Dependency
leopold@lemmy.kde.social · 15 pts · 2y
actual link https://xkcd.com/2347/
wolf@lemmy.zip · 23 pts · 2y
Supply chain attacks are extremely cheap/easy and very effective, so get prepared for more of them in the future.
It really bothers me, that many companies make billions utilizing open source without contributing money/employees etc. to secure/supply/maintain supply chains.
RedNight@lemmy.ml · 11 pts · 2y
This one might not have been that cheap. The malicious code was added by a maintainer on the project for two years. That is some patience
wolf@lemmy.zip · 6 pts · 2y
Agreed. I am more speaking of 'in general', for example there was a supply chain attack on a widely used npm package by writing an email to the author of the npm package. There are other 'cheap' attacks like dependency confusion, typo squatting etc.
NotMyOldRedditName@lemmy.world · 2 pts · 2y
What about finding someone like this and then blackmailing them?
That would be cheaper
SMillerNL@lemmy.world · 3 pts · 2y
https://xkcd.com/538/
bassomitron@lemmy.world · 1 pts · 2y
Lol, too true. It's either that or honeytraps
steal_your_face@lemmy.ml · 10 pts · 2y
Happy it doesn’t affect stable versions
delirious_owl@discuss.online · 2 pts · 2y
Did they intentionally not put the package name in the headline just to draw more clicks? Ffs
annata20@discuss.tchncs.de · 1 pts · 2y