Interesting case study. My background is high assurance security. Most attackers go for subversion there because it&#x27;s powerful. You&#x27;re the only one I&#x27;ve seen in a while to do it because it was easier. Often is if software source or config is available in a centralized place.<p>Btw, here&#x27;s the Myer&#x27;s paper in 1980 that fleshed out the threat and gave the field no excuse to have no seen much of it coming:<p><a href="http:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;history&#x2F;myer80.pdf" rel="nofollow">http:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;history&#x2F;myer80.pdf</a><p>Written in era of time-sharing machines but many (most?) lessons carry over.