Yowza, very targeted: "The injected code targets the Copay application. When a developer at Copay runs one of their release build scripts, the resulting code is modified before being bundled into the application. The code was designed to harvest account details and private keys from accounts having a balance of more than 100 Bitcoin or 1000 Bitcoin Cash."
Has something like this happened with any java packages like in Maven-Central or even Eclipse managed repos ?
This attack started out as a social engineering attack. The attacker, posing as a maintainer, took over maintainership of the event-stream module.
How is this even possible? Shouldn't repo's like this have some serious security measures in place?
The owner didn’t want to maintain it and gave it to the attacker when they asked.
Many repos is just one or two people that work on it in their spare time.