Comment by zarzavat
4 hours ago
Presumably it's so it can be used as a subdependency for setting up an attack in a popular, legitimate package, e.g. via a pull request. The code in the legitimate package would not arouse suspicion at all.
4 hours ago
Presumably it's so it can be used as a subdependency for setting up an attack in a popular, legitimate package, e.g. via a pull request. The code in the legitimate package would not arouse suspicion at all.
Now I'm curious what the target was. Are there any notable classes of programs/problems where you'd do an LU decomposition of this specific matrix?
>Are there any notable classes of programs/problems where you'd do an LU decomposition of this specific matrix?
It doesn't have to be this specific matrix. If it's some service exposed to the internet, it can be user supplied, in which case it turns into a backdoor.