• Alex
    link
    fedilink
    601 year ago

    It’s looking more like a long game to compromise an upstream.

      • Alex
        link
        fedilink
        361 year ago

        Well the account is focused on one particular project which makes sense if you expect to get burned at some point and don’t want all your other exploits to be detected. It looks like there was a second sock puppet account involved in the original attack vector support code.

        We should certainly audit other projects for similar changes from other psudoanonymous accounts.