Transmission BT 2.90 Mac malware. Website compromised?

[Elad Alfassa <elad () fedoraproject org>]

Hello oss-security.

According to these three links,
https://www.reddit.com/r/netsec/comments/498bb7/transmissionbt_290_for_osx_contains_malware/
http://www.cnbc.com/2016/03/06/reuters-america-apple-users-targeted-in-first-known-mac-ransomware-campaign.html
https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834

and the project homepage https://www.transmissionbt.com/

The mac build of version 2.90 of the popular Transmission bittorent
client was infected by malware. However, there's not much information
about the source of the actual malware:

* How did it get to the official download location? Was it a
compromised server or someone with access abusing it to distribute
malware? What steps did the transmission project take to ensure that
the attacker no longer has access to their server? When were the
infected files uploaded to the server? And, most importantly, are
builds for other platforms and source code archive download affected
in any way?

Transmission is included in many Linux distributions (default in some
of them). If the source code archives (which are not signed, there's
only a checksum on their website, but if it was compromised then it's
not exactly useful) used by these distributions to build Transmission
were tampered with as well this might mean malicious code is already
inside the Transmission packages in these distributions. While the
malware mentioned in the link above is Mac specific, it is still
possible that other downloads have been infected by different types of
malware.

Since I couldn't find any security related email address or mailing
list for the transmission project specifically, I'm sending this to
oss-security in hopes that relevant people will see this and will shed
more light on this story.

-- 
-Elad.