Post #1356952
2026-04-18 20:24 UTC
What do I do if I notice a questionable-smelling pattern of open source contributions, but no clear proof of motivation or malice? A Github organization that looks like it's mostly commit farming and trying to collect un-/barely maintained projects, has a website that looks fishy (including mentioning having "supported" projects where someone got a trivial commit merged)… and then the only seemingly consistently active person in the group is trying to become a #Debian Maintainer based on that (and adopting orphaned packages).
Don't want to throw around names without being sure someone's malicious, but also don't want to keep quiet and later find my suspicion was justified. And of course picking up abandoned projects is generally desirable, but these look like barely used ones, too, which again… not bad as such, but smells. What to do? :neocat_floof__w_:
Replies (1)
-
@Fiona@blahaj.zone 2026-04-18 20:38
@airtower@woem.men If you care for my opinion: My first step (if allowed by executive dysfunction) would probably be to contact someone high up in the Debian project, just making sure that they are aware of it. And, in any case, and sorry if this is blunt, ensure that the bus-factor of that knowledge is > 1. I’m of course extremely primed by your framing, but the way you put it, this could indeed be another attempt at an xz-like supply chain attack…