We know that the build and release infrastructure for SolarWinds was compromised to distribute malware signed with their keys. What we don't know is who or what

We know that the build and release infrastructure for SolarWinds was compromised to distribute malware signed with their keys. What we don't know is who or what was responsible. In the sense that JetBrains is in the supply chain and that supply chain was ultimately compromised, the threat is absolutely credible. Other credible threats include every human who touched or has the ability to touch the configuration of their Team City pipelines. However, the Times journalists should get some facts straight before flinging libel around. There are millions of JetBrains users for a wide variety of products. They're implicating all these products, and that doesn't seem to be appropriate. Breaking a text editor or IDE to introduce this class of attack seems unlikely, and much more prone to discovery. Personally, everything about this smells like an inside job (or gross incompetence).