Brian May via luv-main <[email protected]> writes: > This story reminds me of an npm package. The maintainer passed on the > job to a new maintainer as they were no longer interested in maintaining > the package. The new maintainer added a dependancy on another package > which had back door code. Or something like that. Oh, think I found it: > > https://medium.com/intrinsic-blog/compromised-npm-package-event-stream-d47d08605502
Now another example: https://www.securityweek.com/xz-utils-backdoor-attack-brings-another-similar-incident-to-light/ Sure, maybe this was on honest mistake, but it does seem very suspicious. https://social.librem.one/@eighthave/112194828562355097 https://gitlab.com/fdroid/fdroidclient/-/merge_requests/889 -- Brian May @ Linux Penguins _______________________________________________ luv-main mailing list -- [email protected] To unsubscribe send an email to [email protected]
