취약점 없이도 뚫린다 — 오픈소스 개발자를 노린 '신뢰 기반' 공격의 실체

This attack exploits the trust-based foundation of open source communities rather than technical vulnerabilities, making it particularly effective against developers relying on familiar identities and peer networks. The campaign demonstrates how sophisticated social engineering can weaponize community bonds through developer-specific incentives—such as exclusive AI-powered PR prediction tools—to deliver malware and steal credentials. The incident reveals a critical security gap where technical safeguards alone are insufficient without proper identity verification and developer awareness protocols.