Just wanted to follow up and say that Hisham confirmed with me he didn't receive any contact from Vhyrro. Feel free to have Vhyrro forward the emails again so I can find out why all their attempts to report the issue disappeared into both of our spam folders. You are building something very relevant to LuaRocks.org, you should have a direct line of contact with me.
> Apart from that, we couldn't find any alternative way of reaching you.
I'll just be blunt, I find this very hard to believe.
I want to take a moment to express why I feel the way I do. If you were a random security researcher, then great. You tried to contact me, the emails got lost along the way. There isn't much you can do. But from what I can see, you're a member of the Lua community who actively uses LuaRocks.
Did you stop using LuaRocks while you were aware of this issue? Did you instruct other people not to use it within rocks.nvim? For all you knew, every module on the site could have been replaced with malware infecting anyone installing any package. The severity of this was a "drop everything and panic" scenario, not an "I asked a group chat, oh well."
When you say something like, "Apart from that, we couldn't find any alternative way of reaching you," it makes me scratch my head. I am grateful you tried to contact me, but statements like that make it hard for me to give you the benefit of the doubt regarding your attempts to contact me.
And that doesn't event address the parts you glossed over in your account of the situation, specifically the actual exploitation on the production server without clearly stating that from the get-go.
> Apart from that, we couldn't find any alternative way of reaching you.
I'll just be blunt, I find this very hard to believe.
I want to take a moment to express why I feel the way I do. If you were a random security researcher, then great. You tried to contact me, the emails got lost along the way. There isn't much you can do. But from what I can see, you're a member of the Lua community who actively uses LuaRocks.
Did you stop using LuaRocks while you were aware of this issue? Did you instruct other people not to use it within rocks.nvim? For all you knew, every module on the site could have been replaced with malware infecting anyone installing any package. The severity of this was a "drop everything and panic" scenario, not an "I asked a group chat, oh well."
When you say something like, "Apart from that, we couldn't find any alternative way of reaching you," it makes me scratch my head. I am grateful you tried to contact me, but statements like that make it hard for me to give you the benefit of the doubt regarding your attempts to contact me.
And that doesn't event address the parts you glossed over in your account of the situation, specifically the actual exploitation on the production server without clearly stating that from the get-go.