you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 2 years ago*

Part of the payload was in the tarball. There was still a malicious shim in the upstream repo

  • source
  • parent