🚀 AI-picked stocks soar in May. PRFT is +55%—in just 16 days! Don’t miss June’s top picks.Unlock full list

Open source groups say more software projects may have been targeted for sabotage

Published 04/15/2024, 01:48 PM
Updated 04/15/2024, 03:06 PM
© Reuters. FILE PHOTO: Figurines with computers and smartphones are seen in front of the words "Cyber Security" in this illustration taken, February 19, 2024. REUTERS/Dado Ruvic/Illustration/File Photo

By Raphael Satter

WASHINGTON (Reuters) -The recent attempt by an unknown actor to sabotage a widely used software program may have been one of several attempts to subvert key pieces of digital infrastructure across the internet, two open source groups said in an alert published on Monday.

In a joint statement, the Open Source Security Foundation and the OpenJS Foundation said the attempt to insert a secret backdoor into XZ Utils - a little-known program that is baked into Linux operating systems across the world - "may not be an isolated incident."

They said at least three different JavaScript projects were targeted by unnamed individuals demanding suspicious updates or asking to be made maintainers of the targeted software.

The JavaScript programming language powers much of the modern web and sees intensive use across the world. Omkhar Arasaratnam, the Open Source Security Foundation's general manager, said that one of the targeted packages alone saw tens of millions of downloads a week.

He declined to identify the JavaScript projects by name, saying he wanted to protect an ongoing investigation.

© Reuters. FILE PHOTO: Figurines with computers and smartphones are seen in front of the words

Arasaratnam also said that while it wasn't clear what the suspected malicious actors were hoping to do - "we stopped them before they got that far" - he suspected they hoped to build backdoors into those projects as well.

The OpenJS and Open Source Security Foundations said they had warned the U.S. Cybersecurity & Infrastructure Security Agency about the suspected infiltration. The agency did not immediately return a message seeking comment.

Latest comments

Risk Disclosure: Trading in financial instruments and/or cryptocurrencies involves high risks including the risk of losing some, or all, of your investment amount, and may not be suitable for all investors. Prices of cryptocurrencies are extremely volatile and may be affected by external factors such as financial, regulatory or political events. Trading on margin increases the financial risks.
Before deciding to trade in financial instrument or cryptocurrencies you should be fully informed of the risks and costs associated with trading the financial markets, carefully consider your investment objectives, level of experience, and risk appetite, and seek professional advice where needed.
Fusion Media would like to remind you that the data contained in this website is not necessarily real-time nor accurate. The data and prices on the website are not necessarily provided by any market or exchange, but may be provided by market makers, and so prices may not be accurate and may differ from the actual price at any given market, meaning prices are indicative and not appropriate for trading purposes. Fusion Media and any provider of the data contained in this website will not accept liability for any loss or damage as a result of your trading, or your reliance on the information contained within this website.
It is prohibited to use, store, reproduce, display, modify, transmit or distribute the data contained in this website without the explicit prior written permission of Fusion Media and/or the data provider. All intellectual property rights are reserved by the providers and/or the exchange providing the data contained in this website.
Fusion Media may be compensated by the advertisers that appear on the website, based on your interaction with the advertisements or advertisers.
© 2007-2024 - Fusion Media Limited. All Rights Reserved.