everybackdoor

2 года назадdiscuss

Look at the newest commits, do you see anything suspicious:

https://git.alpinelinux.org/aports/log/main/gettext

libunistring could also be affected as that has also been pushed there

2 года назадdiscuss

JiaT75 was also a prolific contributor to xz over the past few years, so your assumptions are generally invalid at this point.

2 года назадdiscuss

Funny you should say that, given they definitely have exploit code in `vcpkg`

2 года назадdiscuss

They may be right: https://git.alpinelinux.org/aports/log/main/gettext

Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!

comments