OpenMandriva Distribution Hit by Sabotage Attempt via GitHub

The OpenMandriva distribution team has issued a statement about an attempt to sabotage its package distribution infrastructure.

What happened

According to the developers, part of the project's GitHub repository was deleted. At the same time, empty packages were pushed to the Cooker repository — the distribution's testing branch.

The goal of the attack, OpenMandriva claims, was to render “obsolete” all packages associated with the GNOME and COSMIC desktop environments, effectively driving them out of the system by replacing them with empty versions.

The project's response

OpenMandriva characterized the incident as an attempt to sabotage the distribution. The team released an official statement to inform users and the community about what had happened.

The announcement does not disclose who is behind the attack or how the perpetrators gained access to the repository.

Why it matters

The OpenMandriva incident illustrates the vulnerability of open source project infrastructure built on third-party platforms like GitHub. Substituting packages in the testing repository could have left users updating their systems from Cooker without the GNOME and COSMIC desktop environments.

Cases like this underscore the importance of maintaining the integrity of the software supply chain even for relatively small Linux distributions, as well as the need to back up critical project infrastructure outside a single platform.

Source: Phoronix