Reputation Farming in OSS: A Threat to Building Trust

Thu, 27 Jun 2024 00:00:00 +0000

This issue complicates the open source and supply chain security space. For attacks like xz, such strategies can be used by attackers to build “fake” trust among fellow OSS community members.

A few days ago, this discussion ignited in the OSSF Slack, which talked about the issue of credibility farming in several open source repositories.

So, the issue revolves around GitHub (or equivalent platforms) accounts approving or commenting on old pull requests and issues that were already resolved or closed, where these meaningless contributions show up prominently on the user’s profile and activity feed, making their involvement seem more significant than it actually is, without closer look.

Two Bits on the xz Vulnerability

Mon, 01 Apr 2024 00:00:00 +0000


GitHub Repository	xz (Suspended)
Source Code	https://git.tukaani.org/?p=xz.git
Threat Actor	Jia Tan (GitHub)
CVE Number	CVE-2024-3094 (CVSS 10.0)
Vulnerability Type	Remote Code Execution
Attack Category	Social Engineering, Supply Chain Attack

What does `xz` module do?#

XZ Utils is a set of free and open-source data compression utilities that provide high compression ratios and fast decompression. It primarily uses the LZMA compression algorithm , which is an algorithm for lossless data compression.

Open-Source-Security on krash.dev

Reputation Farming in OSS: A Threat to Building Trust

Two Bits on the xz Vulnerability

What does xz module do?#

What does `xz` module do?#