Re:Timeline of the xz open source attack
by jsnell on Tuesday April 02, 2024 @03:07PM
(#39909647)
No. The payload was in the checked in test files, but the test files were inert. They were only activated by the tarball having different build files than the repository (or rather, different build files than would be generated by autotools for the repository), which extracted the payload from the test files and injected it into the output binary.
[ Parent
| on HN ]
There are no comments on this comment yet.