Open sourcerers say suspected xz-style attacks continue to target maintainers

OpenJS Foundation and OpenSSF warn of a wave of social-engineering attempts aimed at elevating malicious actors to maintainer status in open-source projects, citing similarity to the recent attempted backdoor in the xz/liblzma library. The report describes suspicious GitHub-associated emails and sockpuppet endorsements, examples of obfuscated or unusual code changes, and deviations from normal build and release processes; it urges maintainers to be vigilant and recommends increased funding and support for security measures across the open-source ecosystem.