Security researchers detail how they could have backdoored Bash through compromised forge
Source: Lwn
A Hacktron research group demonstrated a complete attack chain against GNU Savannah, the infrastructure hosting critical open-source projects, showing that attackers could have injected malware directly into Bash distribution without detection. The vulnerability sits at the infrastructure level: centralized forges depend on maintainer trust and remain single points of failure. A compromise at that layer could affect millions of systems worldwide. Code review and signature practices offer limited protection if the hosting infrastructure itself is compromised.