Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

I would check everything Jia contributor did here in the eyes of the xz compromise #31

Open
ajdelgado opened this issue Mar 30, 2024 · 3 comments
Open

I would check everything Jia contributor did here in the eyes of the xz compromise #31

ajdelgado opened this issue Mar 30, 2024 · 3 comments

Comments

@ajdelgado
Copy link

No description provided.

@conqp
Copy link

conqp commented Mar 30, 2024

They added a .gitignore file: https://github.com/keithn/seatest/commits?author=JiaT75

@hhartzer
Copy link

It seems like the gitignore is harmless, although ironically might be in the same vein as his xz exploit in 5.6.0/5.6.1.

@faizananwerali
Copy link

faizananwerali commented Apr 11, 2024 •
edited
Loading

It seems like the gitignore is harmless, although ironically might be in the same vein as his xz exploit in 5.6.0/5.6.1.

It is harmful. it is the same pattern of attack as in xz.

See all of the pull requests of JiaT75 here in this repo

He added some test files and .gitignore binaries. In compiled files, all the malicious code exists, but not in the repo.

Thankfully none of those major PRs merged.

I believe since he didn't get any response from the author, he left and applied same on xz afterward

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@conqp @ajdelgado @faizananwerali @hhartzer