In my experience, it's a common mantra that open source tends to be secure due to its availability for open scrutiny. I tend to agree with this. At the same time it's no secret that vulnerabilities are constantly discovered.
Moreover, I feel it's easy to imagine that developers very eagerly obtain libraries and tools and that are available in various repositories. I believe that these resources are regularly grabbed hastily for experimentation, and sometimes adopted into larger projects without much scrutiny (maybe besides a license compatibility check, and some assurance that the feature set matches what's desired)
What comes to mind is PyPI, Dockerhub, etc.
I would like to know if there are many documented cases of things like:
- Successful malicious contributions to prevalent open source software
- Smaller projects that popped up that could be considered malware under the guise of providing some simple but appealing functionality
- Reports of foul play on attempted contributions
I understand that be best FOSS projects have high quality maintainers, but I also see this current world of nonstop spamming, phishing, spearphishing, identity theft and aggressive governments. I personally have a difficult time believing that bad actors would ever take a break from trying to make malitious contributions to these projects, given how they seldem take a break from their other nasty tasks.