The questions this backdoor raises:

- what other ones exist by this same team or similar teams?

- how many such teams are operating?

- how many such dependencies are vulnerable to such infiltration attacks? what is our industry’s attack surface for such covert operations?

I think making a graph of all major network services (apache httpd, postgres, mysql, nginx, openssh, dropbear ssh, haproxy, varnish, caddy, squid, postfix, etc) and all of their dependencies and all of the committers to all of those dependencies might be the first step in seeing which parts are the most high value and have attracted the least scrutiny.

This can’t be the first time someone attempted this - this is just the first unsuccessful time. (Yes, I know about the attempted/discovered backdoor in the linux kernel - this is remote and is a horse of a different color).