Alpine Linux allows MALICIOUS package maintainers spread rootkits

[urgentUrrgent]

hi i recently discovered this on accident with no respones from alpine developers

a package maintianer goes by name "omni" who has special interest in tor and cryptographic packages has been pushing advanced rootkits into packages.

tor package for example uses the same package tor to do communcation

i contacted alpine developers with everything and they are simply unresponsive

please execerice caution most of his packages are in 'community' repo however some packages are also in 'main'

[LinuxBender]

Please link to the malicious code and artifacts along with code snippets that would be considered malware / rootkits. If you captured any of the traffic from the rootkit such as network connections, IP addresses, domains and evidence they are malicious that would also be useful along with any other indicators.

[jsheard]

Big if true, but you'll need to provide some evidence of these backdoored packages.