• Alex@lemmy.ml
    link
    fedilink
    arrow-up
    57
    arrow-down
    1
    ·
    8 months ago

    It’s looking more like a long game to compromise an upstream.

    • cjk@feddit.de
      link
      fedilink
      arrow-up
      17
      ·
      8 months ago

      Either that or the attacker was very good at choosing their puppet…

      • Alex@lemmy.ml
        link
        fedilink
        arrow-up
        34
        ·
        8 months ago

        Well the account is focused on one particular project which makes sense if you expect to get burned at some point and don’t want all your other exploits to be detected. It looks like there was a second sock puppet account involved in the original attack vector support code.

        We should certainly audit other projects for similar changes from other psudoanonymous accounts.