[ Thanks to smk for this link.
]
“”The intruder did deploy the modified packages, and
the modified SSH package may have captured passphrases for a short
time,” Frields reported. “However, the investigation supports the
conclusion that the modified packages were discovered before anyone
accessed the system to sign any packages using the modified RPM
package.””