Irenes (many)Though, that said, apparently a portion of the attack vector here was in fact checked into the repo. Like it had (we've read, but not yet looked for ourselves) two components, a tarball that was part of the project's test suite, and an m4 macro that causes data from the tarball to be included in the build. The tarball was checked in to git, the macro was not.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.