The commit timestamps are not a reliable indicator of this actor's work day. It's trivial to work on a different schedule than local 9-5, or simply falsify the time stamps [1].

[1] https://github.com/jbranchaud/blog/blob/master/_posts/2013-0...

People thinking like you still astonishes me. We are talking about someone who is able to build a backdoor like this, and be so careless of:

- using a name that reveals their nationality?

- commiting at a timezone that reveals where are they located?

Please. We have no idea who's behind this. The only legitimate question is (as usual): who benefits from this? Answer: any government on earth (most likely: USA, China, Russia, etc.)