Hacker News Reader

I'd be even more curious to know why people saw that code and thought nothing of it.

No git blame? No bugs around that area? No one questioning what/how/why is that there?

They likely put a program on the build server to make the changes after checkout before build. Which would be impossible to detect.

"impossible to detect" except for all the merge conflicts and build breaking changes, etc

Huh? After the build server checks out the code, write malicious code to the source files directly just before the compilation step. No merge conflicts or breaking changes unless the added code failed to compile. It's reasonable to guess they had access to the source from the build server, so they could reproduce this environment themselves and test on their own.

Reply on news.ycombinator.com