> but why bother when you can compile the app from sources? Well, imagine that you are the attacker here. Would you rather keep your malware source in sync wi

> but why bother when you can compile the app from sources? Well, imagine that you are the attacker here. Would you rather keep your malware source in sync with the upstream code and build every target every update, or just use an off the shelf binary wrapper. Would you answer the same if you were targeting more than one app (in the case of a CDN attack)? The only scenario in which source level malware makes sense to me is this: you are targeting a specific application and you are able to get your code into the project's SCM. In this scenario OSS is no more vulnerable than closed source.