> Now, if that developer is anonymous to you, you have no legal recourse after the developer used their software product to launch a cyber attack on you. It lo

> Now, if that developer is anonymous to you, you have no legal recourse after the developer used their software product to launch a cyber attack on you. It looks like the source is hosted on codeberg, which a company in Germany. Presumably they would know which account was used to sign in and upload the malicious code, and that account would be tied to things like an email address and IP address which could be traced back to a person. It might not always be enough to find the person, but that's always true. Red Hat and The Debian Project being non-anonymous didn't mean they knew who backdoored the XZ Utils package.