Post

Austin Ginder's WP Beacon write-up traces malware in a plugin's SVN trunk. WordPress.org kept serving the unchanged stable ZIP; this wasn't an infected update sent to all installed sites.

wordpress.orgBlog Tool, Publishing Platform, and CMS - WordPress.orgOpen source software which you can use to easily create a beautiful website, blog, or app.

13/10/26, 1:00 pm0 reposts1 like

Within WordPress

@withinwp.com

The reported risk was to anyone pulling the trunk code or running its Node build configuration. Austin reports the repository was cleaned and the listing reopened. anchor.host/grok-bot-fo...

anchor.hostGrok Bot found malware on WP.org during a routine check.Within Grok Bot I have a bot dedicated for WP Beacon. After two weeks of daily checks it pinged me while I was working. Malware in trunk of InstaWP Connect. Directory zip never moved. wordpress.org closed the listing that afternoon and restored it the next morning.