AI Company Uses Social Engineering to Attack Open Source Maintainers and Inject Malicious Code: A Supply Chain Security Wake-Up Call

Incident Overview

Recently, a social engineering attack targeting open source software maintainers has drawn widespread attention across the tech community. Reports indicate that a company called Mythos attempted to use social engineering techniques to trick an open source project maintainer into merging contributions containing malicious code, thereby injecting malware into a widely-used open source software supply chain.

The Open Source Software Supply Chain refers to the complete pipeline from code writing, dependency inclusion, build compilation, to final distribution and deployment. In modern software development, a typical application may depend on hundreds or even thousands of open source components, forming a complex dependency tree. According to a 2024 Synopsys report, 96% of commercial codebases contain open source components, with an average of over 500 open source dependencies per application. This deep coupling means that contamination at any single point in the supply chain can affect countless downstream projects, dramatically amplifying the blast radius.

The core of this type of attack lies in exploiting the trust mechanisms that open source communities rely on to function. Open source projects typically depend on community contributors to submit code, while maintainers must review these contributions. Attackers target precisely this process, attempting to disguise themselves as well-intentioned contributors and conceal malicious logic behind seemingly harmless code submissions.

Social engineering attacks refer to attackers manipulating human psychology and behavior, rather than directly breaching technical defenses, to achieve their malicious objectives. In the open source domain, these attacks often manifest as:

Long-term infiltration, first submitting several legitimate high-quality patches to build trust;
Exploiting maintainer fatigue, understaffing, or goodwill to gradually obtain higher privileges;
Submitting code with hidden backdoors or malicious logic at critical moments, inducing merges.

Most open source maintainers are volunteers who chronically face time pressure and resource constraints. A popular project may have only one or two core maintainers, yet must handle hundreds or thousands of issues and pull requests. According to GitHub's Octoverse report, among the top 1% of open source projects, over 60% of code review work is concentrated on fewer than 3 maintainers. This structural weakness is the breeding ground for social engineering attacks — when maintainers are overwhelmed by a flood of notifications, carefully disguised malicious submissions are more likely to slip through.

Similarities to the XZ Utils Backdoor Incident

The Mythos incident inevitably draws comparisons to the industry-shocking XZ Utils backdoor incident. In that case, an attacker operating under the identity "Jia Tan" infiltrated the project for nearly two years, gradually earning the maintainer's trust through consistent code contributions, and ultimately succeeded in planting a meticulously designed backdoor in a widely-used compression library — nearly compromising the entire Linux ecosystem.

From a technical perspective, XZ Utils is a data compression library pre-installed on virtually all Linux distributions. Its core component, liblzma, is indirectly called by systemd, which in turn affects OpenSSH's authentication process. The attacker began contributing code in 2022, gradually obtained co-maintainer privileges, and then planted the backdoor in the February 2024 releases of versions 5.6.0 and 5.6.1. The backdoor injected a malicious object file through modified build scripts, enabling execution of arbitrary commands specified by the attacker during SSH authentication — essentially a Remote Code Execution (RCE) vulnerability. The incident was accidentally discovered by Microsoft engineer Andres Freund while debugging SSH latency issues — had it not been for this accident, the consequences would have been unimaginable.

Both incidents reveal the same deep-rooted problem: The security of the open source software supply chain ultimately depends on human trust judgments, and this is precisely the most difficult attack surface to defend.

With the development of artificial intelligence technology, the barrier to social engineering attacks is decreasing while efficiency is increasing. Attackers can leverage large language models to:

Batch-generate code contributions that appear professional and conform to project standards;
Fabricate convincing communication scripts that mimic real developers' interaction styles;
Automate simultaneous operations across multiple projects to expand the attack surface.

The ability of Large Language Models (LLMs) to lower the barrier to social engineering attacks has been confirmed by multiple studies. A 2024 UIUC study showed that GPT-4 can autonomously exploit publicly disclosed vulnerabilities with an 87% success rate. In social engineering scenarios, LLMs can analyze a target project's code style, commit message format, and community communication conventions to generate highly customized disguised content. More dangerously, AI can help attackers distribute malicious logic across multiple seemingly harmless commits, with each change being extremely minimal — virtually impossible to detect anomalies when reviewed individually, only triggering malicious behavior when combined. This "low-slow-small" attack pattern poses severe challenges to traditional code review.

While publicly available information has not yet fully disclosed the specific technical details of the Mythos incident, the event itself reflects a trend: Malicious code injection is shifting from purely technical attacks to hybrid "technical + psychological" attacks. Attackers are no longer merely searching for code vulnerabilities but are actively creating and exploiting interpersonal trust vulnerabilities.

How the Open Source Community Should Defend Against Supply Chain Attacks

Strengthening Code Review Mechanisms

Facing increasingly sophisticated supply chain threats, review by a single maintainer is clearly inadequate. Communities can adopt the following measures:

Multi-person review requirement: Critical code merges should require approval from at least two maintainers;
Automated security scanning: Integrate static code analysis and malicious pattern detection into CI/CD pipelines;
Dependency provenance: Implement stricter verification of third-party dependencies and contributor identities.

Regarding CI/CD (Continuous Integration/Continuous Delivery) security integration, modern development teams can deploy multi-layered detection tools in their automated pipelines: SAST (Static Application Security Testing) analyzes source code for vulnerability patterns; SCA (Software Composition Analysis) checks dependent components for known vulnerabilities; SBOM (Software Bill of Materials) generates complete component inventories for audit traceability. GitHub's Dependabot, Google's OSS-Fuzz, and OpenSSF's Scorecard project are all important practical tools in this space, automatically identifying potential security risks before code is merged.

Establishing Contributor Trust Tiers

Drawing lessons from the XZ incident, projects can establish a progressive trust model for contributors, preventing new contributors from gaining high-level privileges too quickly. Additionally, accounts that suddenly become highly active after long periods of inactivity should be treated with vigilance.

The core principle of a progressive trust model is that contributor privileges should be proportional to the quality of their historical contributions, time span, and community recognition. Specific practices include: PRs from new contributors require more reviewers' approval; write access is only granted to members verified over extended periods; modifications to critical modules (such as cryptography and authentication-related code) require additional approval processes. OpenSSF's Sigstore project verifies code provenance through cryptographic signatures, ensuring every commit can be traced to a real identity. The SLSA (Supply-chain Levels for Software Artifacts) framework defines supply chain security maturity levels from L1 to L4, helping projects systematically evaluate and enhance their protection — from basic build records to complete end-to-end verification.

Reducing Maintainer Burden

Fundamentally, many attacks succeed because maintainers are exhausted and lack support. Companies and foundations should increase financial and human resource investment in critical open source projects, giving maintainers sufficient resources to carefully review every contribution. This is not merely a moral obligation but a necessary investment in securing the entire digital infrastructure.

In recent years, the industry has begun to recognize the severity of this problem. The Linux Foundation and OpenSSF jointly launched the Alpha-Omega project, aimed at providing security audit resources for the most critical open source projects. Google's Open Source Security Team and the Sovereign Tech Fund (funded by the German government) are also injecting capital into critical open source infrastructure. However, compared to the trillions of dollars in value that open source software creates for the global digital economy, these investments remain a drop in the bucket. According to a 2024 Harvard University study, the cost of rebuilding existing open source software exceeds $8.8 trillion, yet global annual investment in its security maintenance amounts to less than 0.01% of this value.

Conclusion

Mythos's attempt to inject malicious code through social engineering serves as yet another alarm bell for the entire software industry. Open source software forms the foundation of the modern digital world — from operating systems to cloud infrastructure, everything depends on it. Yet the security of this edifice often hangs on the trust judgments of a handful of volunteers.

In an era where AI technology makes attacks cheaper and more covert, we need to re-examine the security model of open source supply chains — not only fortifying technical defenses but also protecting and supporting the people who quietly maintain critical projects. Because in this adversarial game, the strongest yet most vulnerable line of defense has always been people.

AI Company Uses Social Engineering to Attack Open Source Maintainers and Inject Malicious Code: A Supply Chain Security Wake-Up Call

Incident Overview

Similarities to the XZ Utils Backdoor Incident