The Social Engineering Playbook Attackers Use to Target OSS Maintainers

This article catalogs common social-engineering techniques attackers use to compromise open-source maintainers—credential phishing (typosquatting and adversary-in-the-middle), abuse of platform administrative flows, long-term trust-building infiltration, fake job interviews that deliver RATs, and ownership transfers of abandoned packages—illustrated by incidents such as axios, chalk/debug, eslint-config-prettier, event-stream, XZ Utils, and the North Korea-linked Contagious Interview campaign, and concludes with practical mitigations (hardware keys, short-lived tokens/Trusted Publishing, separation of build machines, offline recovery codes, and release cooldowns).