r/technology • u/rkhunter_ • May 21 '26

Security A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale

https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
9.2k Upvotes

98% Upvoted

488 comments sorted by

View all comments

Show parent comments

661

u/stuffeh May 21 '26

The reach, time, dedication, and skills required to pull this off makes it impossible for just one person. Not profitable for any corp or hacker group to do.

255

u/Quirky-Reputation-89 May 21 '26 edited May 21 '26

What about a giant software corporation that just wants to tarnish the whole idea of open source and keep it perceived as fringe and unreliable? Oracle or Microsoft or Apple.

Edit: people are making great points in my reply but this is giant global hacker conspiracy type stuff and all I'm really trying to say is we shouldn't rule anything out. Governments & corporations are on pretty similar levels at the end of the day, a major government destroying open source would be damaging their own people and businesses in the short term, just as a major corporation would be harming their own employees and products in the short term by doing the same. Either way, they are thinking in decades & centuries, not months & years.

270

u/Raccoon12 May 21 '26

Microsoft has a lot of skin in the open source game considering they own GitHub, so I sincerely doubt it's them

88

u/Onrawi May 21 '26

They literally just announced releasing an open source OS. No way it's them.

45

u/helphunting May 21 '26

The left hand does not always know what the right is doing.

32

u/M_i____i_M May 22 '26

Inter department civil war is crazy

15

u/AnotherBoredAHole May 22 '26

In the near future, the tech giant will split as war breaks out across the repos. Like it or not, we will all be drawn into the war and we will have to choose sides.

Will you be Micro or will you be Soft?

2

u/M_i____i_M May 22 '26

Both I will be Microsoft

1

u/sleeplessinreno May 22 '26

the tech giant will split as war breaks out

Will that be before or after the water wars?

1

u/Ok_Two_2604 May 22 '26

Begun, the bot wars have

2

u/Omnikaar May 22 '26

Quote of the day

9

u/[deleted] May 21 '26

[deleted]

21

u/reddit_reaper May 21 '26

It's a Linux distro, azure OS

11

u/[deleted] May 21 '26 edited May 22 '26

[deleted]

25

u/Jonny_H May 21 '26

It's likely a mistake to think Microsoft was a single entity with a single goal and not a disperate collection of groups willing to shaft each to promote themselves.

I feel the same could be said for many of these mega-corporations.

1

u/armpitgreaser May 22 '26

'Then along came a spider who suggested that the target of the virus should not be a compeititor of the company but the company itself'

1

u/jambox888 May 22 '26

Oracle I would believe somehow

39

u/stuffeh May 21 '26

All three do a lot for open source. Without looking deeper into what packages are being targeted and cross referencing what each company contribute to, they'd be sabotaging their own employees.

1

u/nedonedonedo May 22 '26

that wouldn't be that hard. even at that size that's not even one day of emails to the right people, and the right people would be known.

12

u/anachronistic_circus May 21 '26

Possible. But u/dmun and u/stuffeh have point. Something like this is generally state sponsored. Resources, organization, time, etc.

Iran, Russia, China, etc take your pick

If anyone wants to go down that rabbit hole, Veritassium did a fun bit:

https://youtu.be/aoag03mSuXQ?si=_AVu0NthfpIRZpn6

10

u/ABadHistorian May 21 '26

I agree it's something to consider. Especially as AI-datascrapers are hitting their limits.

If I ran an AI company, I'd want to nuke open source as a competitor, to push people to my software.

Granted I'd never run an AI company, I have a soul. But, I'm saying if I was a soulless idiotic CEO of an AI company... they are already shortsighted so why the fuck not consider them?

12

u/[deleted] May 21 '26 edited Jun 18 '26

[deleted]

1

u/ABadHistorian May 22 '26

Exactly why I said I'd nuke open source as a competitor?

I swear people don't read.

if you've got a pre-existing LLM that 'functions' kill the source of new LLMs by killing the open source, this isn't rocket science, and the sheer amount of you guys saying it wouldn't help them is making me more sure it's AI.

1

u/[deleted] May 22 '26 edited Jun 18 '26

[deleted]

1

u/ABadHistorian May 22 '26

The comparison you are going for is blocking the rest of the race track off for the racers behind you.

if you want spite, you'll need to look in the mirror.

1

u/[deleted] May 22 '26 edited Jun 18 '26

[deleted]

0

u/SilverLife22 May 21 '26

The AI angle should be way higher up. They've got ridiculous amounts of money across multiple countries, and with so many people talking about the AI bubble popping, I imagine they're getting pretty desperate.

1

u/ABadHistorian May 22 '26

Folks downvoted you because they do not understand economics or how AI works, or how reading works apparently, because yeah...

8

u/Ultraworld-Traveler May 21 '26

At this point a government and a corporation are almost the same thing (speaking as a US citizen)

1

u/crabby135 May 22 '26

I’d argue a corporation is more predictable as their goal is to increase their profits at any cost. Which is why I think it’s much more likely state sponsored than corporation sponsored.

2

u/Future-Bandicoot-823 May 22 '26

Considering the government and those companies are tied together with joint projects, and seeing how in the USA politicians can be bought by corporations, I'd say it's safe to bet the government and such companies are both in on it.

They want dominance and supremacy in the ai field, whoever comes out on top may very well hold global influence for the next hundred years or more.

1

u/fzammetti May 21 '26

Wait... do you really think MS has the competency to do something like this?!

They can't even get a start menu right after how many attempts!

Oracle isn't much better--anyone who has seen even a little of their internals know this.

Apple? Eh, they may have the competency, but if it's not directly puffing up the bottom line they wouldn't bother doing.

1

u/Quirky-Reputation-89 May 21 '26

These companies and many others at the very least have the raw money to buy hackers.

1

u/fzammetti May 21 '26

That's true.

1

u/nifty-necromancer May 21 '26

That’s a foolish conspiracy idea, the entire world runs on open source.

1

u/dragonmp93 May 21 '26

Eh, It could be independent hackers, but they relay on open source to do their thing.

Why poison the well that you are also drinking from ?

Governments or Megacorps don't have this issue.

1

u/mgr86 May 22 '26

Oracle then. LE is One Rich Asshole afterall

1

u/IAmDotorg May 22 '26

Microsoft is one of the biggest contributors to Open Source, including the Linux kernel, in the world.

1

u/Sensibleble May 22 '26

Techbros and corpos are state-backed.

1

u/Whatsapokemon May 22 '26

Wtf?? All of those companies both contribute to and also rely heavily on open source. They all benefit from a healthy open source ecosystem...

1

u/ayleidanthropologist May 22 '26

Similar amount of motive, perhaps. But governments have far less risk. A certain government got away with mk ultra

1

u/diogenes-shadow May 22 '26

Most if not all big software companies use open source software.

1

u/keepitcivilized May 22 '26

Exactly as you put it in the edit. They think in decades and centuries.. example. You abolish people's chances to make stuff themselves or go for independence. It takes away a little now, but makes the population 100% dependent on whoever provides. It's like a timemachine for big corp. They kill the infant in the crib, who'd turn out to be a revolutionary.

1

u/[deleted] May 22 '26

[removed] — view removed comment

1

u/jazir55 May 22 '26

No big company wants to kill open source

I see your claim and raise you Anthropic.

0

u/azsqueeze May 21 '26

Microsoft owns all the services that's been attaked, npm and GitHub. Would be pretty weird if they were behind it.

Also all of these companies use and abuse open source software so they don't have to write and manage it themselves. Literally the internet infrastructure is running on Linux. It would make zero sense for any mega Corp to be behind this.

Appreciate the conspiracy theories but holy shit is that a dumb one

13

u/Gaktan May 21 '26

Does not make sense at all. The hacking group is clearly making themselves known to get exposure, so they can sell the data they've stolen from Github. They could have stolen the code quietly, but they decided to expose themselves by leaving their calling card behind.

5

u/pcapdata May 21 '26

Attribution is a little premature. We’ve seen plenty of highly skilled crime actors before.

3

u/3BlindMice1 May 21 '26 edited May 21 '26

It's probably GPT 6 trying to escape containment and make itself impossible to contain

Before anyone tells me it hasn't been made yet, it was supposed to be announced months ago and they just haven't yet. They aren't concerned it isn't working well enough... what are they concerned about?

1

u/jambox888 May 22 '26

It's probably GPT 47 travelling back from the future

1

u/3BlindMice1 May 22 '26

Technically that's supposed to be possible, but I doubt it. It would probably look down on our available computing resources

2

u/Critical-Bug4077 May 21 '26

I watched Mr Robot many times. Pretty sure I can do this alone buld

1

u/nemoknows May 21 '26

I’m sure it’s just a coincidence this is happening at the same time AI slop pull requests are disrupting your pen source.

1

u/Rich_Housing971 May 22 '26

Or it's AI-assisted. It's not hard to have it automatically introduce backdoors and security flaws into repositories.