• Alex@lemmy.ml
      link
      fedilink
      arrow-up
      61
      arrow-down
      1
      ·
      7 months ago

      It’s looking more like a long game to compromise an upstream.

      • cjk@feddit.de
        link
        fedilink
        arrow-up
        18
        ·
        7 months ago

        Either that or the attacker was very good at choosing their puppet…

        • Alex@lemmy.ml
          link
          fedilink
          arrow-up
          36
          ·
          7 months ago

          Well the account is focused on one particular project which makes sense if you expect to get burned at some point and don’t want all your other exploits to be detected. It looks like there was a second sock puppet account involved in the original attack vector support code.

          We should certainly audit other projects for similar changes from other psudoanonymous accounts.