Malicious code in XZ supply chain and releases

[barbaz]

https://security.archlinux.org/CVE-2024-3094
https://arstechnica.com/security/2024/0 ... nnections/
https://gist.github.com/thesamesam/2239 ... 78baad9e27

[barbaz]

Now this is interesting: Someone is making the point that because affected versions of xz-utils are GPL-licensed, the malware author and the xz-utils project are both legally required to provide the full source code for the malware (which was distributed only in obfuscated binary form) - github.com/tukaani-project/.github/issues/2

EDIT Broke dead link as both that issue and the account that posted it appear to have been deleted.

[therube]

A Microcosm of the interactions in Open Source projects