Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently targeting the Linux xz data compression library, XZ Utils [linuxsecurity.com].

you are viewing a single comment's thread
view the rest of the comments

[–] bizdelnick@lemmy.ml 9 points 7 months ago (2 children)

Continue? There are no details on attack attempts published, even when they occured.

[–] 0nekoneko7@lemmy.world -1 points 7 months ago* (last edited 7 months ago) (1 children)

read the full article. there it's mentioned that there were similar attempts on popular OpenJS projects. "The emails were sent from different names, all with GitHub-associated email addresses, and were constructed around the same theme. The suspected attackers were trying to get themselves added as project maintainers to “address any critical vulnerabilities” but didn’t provide details on these vulnerabilities, which raises suspicion."

[–] bizdelnick@lemmy.ml 8 points 6 months ago* (last edited 6 months ago)

I have read this. There are no details about attacked projects, mail texts, addresses and github logins, nothing. It's even impossible to ensure that attack attempts really took place. One may guess they occured before the xz attack disclosure and were performed by different actors because thay seem much more dumb.

[–] 0nekoneko7@lemmy.world -1 points 7 months ago

here's the link to the source information of that article. Read it in full. https://openjsf.org/blog/openssf-openjs-alert-social-engineering-takeovers