Revisiting a major past incident for the lessons that still apply to your operations.
What happened
The library was under-maintained, long carried by a single person. Another individual contributed steadily, built up trust, and eventually gained co-maintainer status. Then, hidden in ordinary updates, they added, step by step, a mechanism allowing unauthorized external access under specific conditions.
What was targeted wasn't a flaw in the code, but the assumption that "a trusted person's legitimate update" is safe.
People and trust were the target
Firewalls and patches don't stop this. OSS maintainers run on goodwill and volunteer time, and attackers exploited that overload and isolation. It showed that the health of the people and projects behind OSS is itself a security matter.
How it was found: an engineer investigated a slow login
It was found when an engineer, during unrelated work, noticed a login path was "clearly slower than before" and the benchmark numbers looked off, and traced the cause instead of ignoring it. As a result, it was caught before it spread widely into stable releases, preventing widespread damage.
Not ignoring the feeling that "something is off" turned out to be the most effective detection method in this case.
Timeline
years prior
The attacker contributes steadily, building maintainer trust.early 2024
A backdoor is staged into legitimate updates, in steps.2024-03
An engineer chases a "slow" anomaly; it's caught and disclosed just before stable.
Lessons that still apply
Minimize dependencies
Fewer libraries means fewer parties to trust. Don't add "because it's convenient."
Pin versions, watch changes
Lockfiles catch unexpected updates; look at the content of important dependency changes (who, what).
Improve build reproducibility
The more the same input yields the same artifact, the easier quiet tampering is to spot.
Never ignore an anomaly
"Feels slow / off" is an important clue; this discovery started there. Make a habit of following small anomalies to their cause.
Respect and support maintainers
The health of the OSS you depend on ultimately affects your own safety. Maintainer overload and isolation can be exploited by attackers.
Read next
- Glossary: What is a backdoor (how it works, how to spot it) · What is a CVE · What is RCE
- Incident: Codecov — a CI tool altered at its source
- Defense: Machine-monitor your dependencies
Sources and scope
These primary references support the settings, scope or remediation discussed above; links were checked on October 23, 2026. Consult their version and configuration conditions. Checklist priorities and lessons are this site's guidance, not a full-article revalidation or a safety guarantee.