“It’s also good to keep in mind that this is an unpaid hobby project.”
Lasse Collin wrote that in June 2022 while sock puppets named Jigar Kumar and Dennis Ens hounded him about slow releases and his mental health. Jia Tan had been sending harmless patches since October 2021. By March 2023 Jia was tagging releases, and in February 2024 the backdoor went in hidden inside binary test files. A dependency of sshd on Debian, Ubuntu and Fedora was one burned-out volunteer away from handing strangers remote code execution. Every company shipping those distros got the code for free and paid nothing to keep him going.