Loading story…
Void Linux removed 113 packages from its repository after an investigation into AI-assisted changes by developer Andrea Brancaleoni, who subsequently left the project. Affected packages included alacritty, docker-cli, etcd, Kubernetes, Terraform, Vagrant, and virt-manager; the review focused particularly on new Go dependencies and build-system changes.
Void Core Team said the questioned patches had been generated with the OpenCode AI agent using the GLM-5.3-flash model. The team found no evidence of an intentional attempt to introduce malicious code, but deemed the changes inappropriate because of quality and correctness concerns, especially in Go-related modifications, and said the developer's access would not be restored.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Andrea Brancaleoni reportedly removed 113 packages from the Void Linux repository and left the project following the dispute. Void Core Team characterized the AI-generated changes as unacceptable and indicated that the developer's account or access would not be restored.
Void Core Team investigated the suspicious modifications after concerns about unsafe or potentially malicious changes. It determined the changes had been generated using the OpenCode AI agent with the GLM-5.3-flash model, while stating it found no evidence of deliberate malicious-code insertion.
Void Linux developer Andrea Brancaleoni submitted package and code changes affecting 113 repository packages, including alacritty, docker-cli, etcd, Kubernetes, Terraform, Vagrant, and virt-manager. The changes included new dependencies and Go-related build or code modifications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fedora maintainers and Red Hat engineer Adam Williamson raised concerns that contributor Nathan Giovannini used suspected AI-generated bug reports and package submissions as part of a broader pattern of inauthentic activity. The allegations drew added scrutiny because they echoed ecosystem fears after the `xz` backdoor case: maintainers said multiple GitHub accounts appeared linked to the same person, profile and contact details were reused, and several reports and code changes showed signs of low-quality or machine-generated content intended to build trust inside the project. Fedora reviewed bug reports and package changes tied to the contributor, closing some issues as **NOTABUG** and examining modifications affecting projects including **Anaconda**, **osc**, **lxqt-policykit**, **gwenview**, and **easyeffects**. At least one Anaconda change was merged into version `45.5` and later reverted in `45.6`, while Fedora maintainers said access was disabled or removed after the concerns surfaced, though they also noted that not every allegation had been definitively proven.
Jun 29, 2026
OpenMandriva disclosed an attempted sabotage of its distribution infrastructure after a contributor allegedly abused administrative privileges, deleting part of the project's GitHub repositories and pushing an empty package into the `Cooker` repository. The malicious package reportedly used the `Obsoletes:` field in an apparent attempt to remove or supersede large sets of **GNOME** and **COSMIC** packages, but the changes were detected before release and did not reach users. The incident followed a broader governance and access crisis tied to the departure and loss of privileges of a key contributor who controlled important GitHub-based development and package-maintenance resources. OpenMandriva said the disruption affected repository access, package updates, and maintenance work, including some desktop-related packages and other delayed updates, and the project is now restoring deleted repositories, rebuilding workflows, and migrating package management infrastructure from GitHub to **OneDev** to reduce the risk of similar abuse.
Jul 10, 2026
GNOME's security team changed its vulnerability-handling process by cutting the default disclosure deadline for new reports from 90 days to 30 days and by declining to forward reports to projects that prohibit AI-generated submissions. The policy shift, discussed widely on the `oss-sec` mailing list, reflects the view that most embargoed fixes are completed within the first month and that AI-assisted reporting has become common enough that many submissions now contain at least some machine-generated material. Participants also noted that some projects, including the Linux kernel, have moved away from embargoes for AI-generated reports because such findings can be easily reproduced and redistributed. The change triggered a broader dispute over open-source security governance, with maintainers arguing that low-quality, verbose, or impractical AI-assisted reports are consuming scarce triage capacity and pushing burnout onto already overstretched teams. Mailing-list contributors said many externally submitted bugs are real defects but not necessarily exploitable vulnerabilities, while others warned that rejecting accurate reports could still increase user risk. The debate expanded to the Linux Foundation's **Akrites** initiative, described by critics as an attempt to coordinate AI-era vulnerability response and potentially serve as a "maintainer of last resort" for abandoned critical packages, though others stressed that such a role would not override project ownership or maintainer authority.
Aug 6, 2026