Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack

I find this astonishing.

I worked at Automatic (in Support / Spam blog hunting / Akismet) in 2011 and after some bad plugin updating from various sources Matt asked me to start vetting wporg plugin updates.

I cannot code in PHP. Lots of reading later I could recognise dodgy code, or code that looked odd.

I set up a gmail account where _every_ new plugin commit was sent to, and I create a ton of filters, each looking for certain code. Those filters were then sent to me and were filtered again - think "Nasty, Maybe, Check"

When something bad happened, I'd review the commits, see the nasty, remove it, update the version, commit to the wporg repo and at the same time take over the account. (Again I can't code PHP but I'm listed as a developer in the plugin repo). That way plugin user was protected.

That was 13 years ago .. why the hell doesn't WP have a better system?

Glad they listed the plugins. I know that its not uncommon to read about some infected app that was on the app store and yet they never directly mention the app by name, just that is been removed.

i wonder if there is a mathematical proof that future AI can never respect wordpress due to infinite history of bad press