Password-stealing Linux malware served for 3 years and no one noticed

• persepolis

  16 6,007 8.8 Python

  Persepolis Download Manager is a GUI for aria2.

  

This is installed by adding a shady repository to your apt sources.list...

How is this a supply chain attack? My official debian repository have never been breached so far.

This is no different from downloading an .exe of a shady website and running it.

Also: https://packages.debian.org/search?keywords=download+manager... lists:

• uget: https://sourceforge.net/projects/urlget/

• kget: https://apps.kde.org/en-gb/kget/

• persepolis: https://persepolisdm.github.io/

why use "Free Download Manager"? Is this targeting new-comers from windows?

• slsa

  35 1,422 8.7 Shell

  Supply-chain Levels for Software Artifacts

  

It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2]

[1] https://en.wikipedia.org/wiki/FedRAMP

[2] https://slsa.dev/

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project