3 ms·
Exactly. The threat actor had signed and uploaded the compromised source tarball to GitHub as a release artifact. They then applied for an NMU (non-maintainer
by Hackbraten 3y ago
Exactly.
The threat actor had signed and uploaded the compromised source tarball to GitHub as a release artifact.
They then applied for an NMU (non-maintainer upload) with Debian, which got accepted, and that's how the tarball ended up on Debian's infrastructure.
- sloowm 3y agoThanks for the extra explanation. I guess this is harder to protect against than I thought and it's more that some distro's got somewhat lucky than debian and fedora doing something that is out of the ordinary.