Loading story…
OpenMandriva disclosed an attempted sabotage of its distribution infrastructure after a contributor allegedly abused administrative privileges, deleting part of the project's GitHub repositories and pushing an empty package into the Cooker repository. The malicious package reportedly used the Obsoletes: field in an apparent attempt to remove or supersede large sets of GNOME and COSMIC packages, but the changes were detected before release and did not reach users.
The incident followed a broader governance and access crisis tied to the departure and loss of privileges of a key contributor who controlled important GitHub-based development and package-maintenance resources. OpenMandriva said the disruption affected repository access, package updates, and maintenance work, including some desktop-related packages and other delayed updates, and the project is now restoring deleted repositories, rebuilding workflows, and migrating package management infrastructure from GitHub to OneDev to reduce the risk of similar abuse.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
OpenMandriva said it is conducting a full system audit to identify any additional unauthorized changes following the alleged internal sabotage incident. The review accompanies ongoing restoration of deleted repositories and packages.
In response to the sabotage and access crisis, OpenMandriva began restoring deleted repositories, rebuilding maintenance processes, and migrating package management infrastructure from GitHub to OneDev to reduce the risk of similar abuse.
The attacker pushed an empty package or harmful package changes into the OpenMandriva Cooker repository, using package metadata such as the "Obsoletes:" field to target GNOME and COSMIC-related packages. OpenMandriva said the changes were detected before release and did not reach users.
OpenMandriva disclosed that a contributor allegedly abused administrative privileges after another contributor was removed from the Matrix chat for abusive behavior. The activity included deleting part of the project's GitHub repository and disrupting development infrastructure.
Following the incident and leadership departure, OpenMandriva said package updates and repository maintenance were disrupted, affecting Cooker and some desktop-related packages, with additional delays noted for work such as Mumble packaging.
OpenMandriva reported that former contributor Davide Beatrici lost maintainer status and package management privileges before the subsequent malicious activity against the project.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcebleepingcomputer.com
Open sourceforum.openmandriva.org
Open sourceopenmandriva.org
Open sourcephoronix.com
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious supply-chain backdoor was discovered in **XZ Utils** versions `5.6.0` and `5.6.1`, tracked as **`CVE-2024-3094`**, after PostgreSQL developer and Microsoft engineer **Andres Freund** investigated unusual CPU behavior and traced it to `liblzma`. The tampering was hidden in release tarballs rather than plainly visible in the main Git repository, using an obfuscated **M4 macro** during the build process to generate second-stage artifacts that altered library behavior. Researchers and vendors said the poisoned build could interfere with **OpenSSH** authentication through `systemd`, creating a path for unauthorized remote access to affected Linux systems. Red Hat said **Red Hat Enterprise Linux** was not affected, but compromised packages reached **Fedora Rawhide** and **Fedora Linux 40 beta**, prompting urgent downgrade and rollback guidance to safe `5.4.x` releases; Fedora 40 reportedly did not show successful execution of the injected code. Reports also said the malicious build succeeded in **Debian unstable (Sid)**, appeared in a Debian beta branch, affected several **openSUSE** distributions, and was noted by **Kali Linux**, while stable Debian releases were not known to be impacted. The incident was widely described as a near-catastrophic attack on Linux infrastructure, with scrutiny falling on maintainer account **Jia Tan / JiaT75** and an apparent long-running social-engineering effort to gain influence over the project.
Jun 29, 2026
Arch Linux temporarily disabled package adoptions in the Arch User Repository (AUR) after maintainers reported another wave of malicious package activity affecting dozens of packages. Reports highlighted suspicious adoptions and package changes tied to entries including **`i915-sriov-dkms`**, **`rtk-git`**, **`boringssl-git`/`hasher`**, **`archutil`/`linter`**, **`warp-terminal-git`**, **`weather-display`**, and **`astro-box`**, prompting the project to investigate and contain the abuse. Community members had already begun flagging seemingly malicious AUR packages in public forums, asking where to report them as concerns spread among Arch users. The latest incident follows a previous large-scale AUR abuse case involving more than 1,500 malicious packages, and Arch maintainers urged users to stay vigilant and report suspicious package adoptions and comments while mitigations remain in place.
Aug 3, 2026
A report from OpenSource Malware says the DPRK-linked **PolinRider** campaign compromised legitimate GitHub maintainer accounts and used them to publish malicious npm releases, highlighting a case involving developer **DiogoAngelim** and the packages `fetch-page-assets` and `html-to-gutenberg`. The report says `fetch-page-assets` version `1.2.9` was identified and removed under advisory `GHSA-vxq2-vhm7-7mhq`, but attackers continued publishing malicious versions `1.2.10` through `1.2.14`, with payloads tied to **PolinRider/NullReceiver** concealed in files including `.vscode/tasks.json`, a fake `.woff2` font, and later `babel.config.cjs`. The article says the compromise extended beyond a single package: all seven non-archived public repositories under the maintainer’s account were allegedly reinfected in coordinated force-push waves, indicating sustained attacker control over both the GitHub account and build environment. OpenSource Malware estimates the campaign has reached **4,367 repositories across 2,152 owners** and argues that current GitHub and npm response mechanisms, which focus on removing specific malicious versions, are insufficient when attackers retain control of trusted maintainer accounts and can repeatedly ship new poisoned releases.
Aug 25, 2026