You ever get offended that the attacker is so obviously incompetent? At least put in the work like the xz attacker.
There are very few people who can do that.
The combination of all three tends to mostly appear in nation states. They have the motive, and they have the money to fund people with the ability to pull off this kind of attack.
Plenty of expired npm maintainer email domains right now. Have fun.
I have done it twice to bring exposure to the issue. Seemingly no one cares enough to do the most basic things like code signing.
It's news cycle should have conveyed a sense of "oh shit, we really do need to be watching for discretely malicious contributors" not "whoa, I can't believe there was someone capable of that!" -- it seems like you learned the wrong lesson.
Judging how many drive by's a random ipv4 address gets on aws, gcp, azure, or vultr- they get ignored if they get it wrong, and nobody notices until too late if they get it right.
It's akin to putting an exploit into say some security software. It's probably going to have access to something you care about.
you’re right. What made the XZ attacker rather unique is the fact they made useful contributions at first and only turned nasty later on.
Not many people can keep a malicious campaign going on as long as the XZ attacker did which is why it’s suspected to be a nation-backed attack
They were even better, the library behaved completely normal when used anywhere else.
xz was found because it behaved differently.