3 ms·
If this is malicious, then I don't understand why the evil code was in the public repository instead of just in the binary.
by eternauta3k 3y ago
If this is malicious, then I don't understand why the evil code was in the public repository instead of just in the binary.
- nightpool 3y agobecause people are stupid and maintaining a separate private fork is more annoying than it's worth?
- lxgr 3y agoIf the intention here was really to steal passwords, it could also be deniability? Uploading sensitive stuff to logging and/or analytics packages or third party providers is a surprisingly easy mistake to make – which in turn makes it an excellent avenue for plausible deniability. It can be really hard to tell which one it was without inside information or a detailed investigation.