Suspected China-state hackers used update infrastructure to deliver backdoored version.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 9 months ago (2 children)

This doesn't seem like this is an attack that should work.

How did this bypass signature verification, sure you can send a malicious update... but unless you have the package maintainer's private keys you can't sign it so it would be thrown out by the package manager?

  • source
  • hideshow 2 child comments