Re:ImageGlass added malware with this commit
by anaisbetts on Saturday January 22, 2022 @11:23AM
(#30037997)
If he was adding it in bad faith, why would he put it on GitHub for all to see, rather than building the binaries in a private fork? Seems like this is incompetence / naivete rather than malice.
[ Parent
| on HN ]
Re:ImageGlass added malware with this commit
by dymk on Saturday January 22, 2022 @11:32AM
(#30038078)
He put the code in a commit titled "restructure external dlls" with no reference to what it did, and in other commits includes the string "Spider" (no description of _what_ that does in the title). These weren't added as pull requests where one might expect to review proposed changes, but as direct commits to ~master.
It's not uncommon for people to put obfuscated malware into open source code See: hackers putting cryptominers and wallet stealers [0] into compromised NPM packages, or UoM campus being banned from contributing to Linux for backdooring the Linux kernel [1].
[0] https://www.trendmicro.com/vinfo/dk/security/news/cybercrime...
[1] https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...