Recently the security of open source software has been questioned, particularly with respect to Linux vulnerabilities that have a huge impact due to Linux’s use as internet infrastructure. When volunteer coders are keeping the software secure – who takes responsibility. Steps have started to be taken to increase the security of these open source package – such as this investment through the Linux Foundation:
Addressing Linux vulnerabilities – Smart Thinking Solutions
However it has now been discovered that malicious code has been introduced to open source software, by a trusted developer:
Sabotage: Code added to popular NPM package wiped files in Russia and Belarus | Ars Technica
This was targeted at computers in Russia and Belarus – but once the code is there, in open source software, what is to stop another “developer with a cause” targeting it at UK computers?
