Investigate claimed unauthorized project access

In the Drupal slack, I came across a message from @mxh saying that somebody suddenly had maintainer permissions on the Imagepin project. To mxh's knowledge, this access was not handed out by mxh or any of the other comaintainers (though he also said that he did not investigate in the interest of not wasting time -- full conversation is below).

I did some looking and it appears that the user in question is @nitesh624. Given his other contributions + social media presence, I believe that he means well and was probably given access by somebody who had access to do so. It appears that this access was requested/granted via some informal means (perhaps by direct email or something), as I could not find any issue in the imagepin or projectownership queue requesting access to this project. The revision history on the project also does not show maintainership changes as far as I can see (which would be very useful), so it's not clear who would have made this change. We also don't retain watchdog logs long enough to be able to see when those changes would have been made, so I wasn't able to glean any additional information from that avenue either.

The reason that I bring this up is that if this access was truly unauthorized, it represents a significant supply chain vulnerability for any Drupal site. I'm inclined to believe that this was a simple miscommunication somewhere + not following the standard request process, but let's be certain that's all it was.

I'm aware of https://www.drupal.org/project/site_moderators/issues/3218459, but the events referenced here happened in early April (before the new project takeover process was finalized/published).

I have elevated access on Drupal.org, but the information that follows is everything relevant that my access allows me to view (as far as I know). Since I can't come to any specific conclusion on this on my own, I thought it would be best to bring this to the attention of a wider group of admins.

As far as I can see, this is the timeline of relevant events:

Timeline:

August 11, 2020:

• Imagepin project was edited by chr.fritsch: https://www.drupal.org/node/2864156/revisions/12023750/view (the length of time between this edit and the next one + any activity from nitesh624 on the project is the biggest open question in my mind -- did chr.fritsch give nitesh624 access on this edit & nitesh624 just didn't have time to do anything with the project until 8 months later? or was this edit unrelated?)

April 10, 2021:

• Two edits to the imagepin project node were made by nitesh624 ( https://www.drupal.org/node/2864156/revisions/12262107/view then https://www.drupal.org/node/2864156/revisions/12262110/view )
• 2.0.x branch was created (presumably by nitesh624, but I don't think we log branch creation anywhere that I have access to)
• 2.0.x-dev release was created by nitesh624: https://www.drupal.org/project/imagepin/releases/2.0.x-dev
• 8.x-1.0-beta12 release was created by nitesh624: https://www.drupal.org/project/imagepin/releases/8.x-1.0-beta12
• https://www.drupal.org/commitlog/commit/92009/2d1869f048fd1792a760cf9f31... was committed by nitesh624

April 11, 2021:

• mxh follows up in the issue queue re nitesh624's commit: https://www.drupal.org/project/imagepin/issues/3207018#comment-14056680

May 5, 2021:

• https://www.drupal.org/commitlog/commit/92009/ce91658b6207f4e5734e557c80... was committed by nitesh624 in response to mxh's message on April 11
• 8.x-1.0-beta13 release was created by nitesh624: https://www.drupal.org/project/imagepin/releases/8.x-1.0-beta13
• mxh opens https://www.drupal.org/project/imagepin/issues/3212312

June 23, 2021:

• mxh closes the issue he opened on May 5 (https://www.drupal.org/project/imagepin/issues/3212312#comment-14143145)
• Imagepin project page was edited by mxh (presumably to remove nitesh624 from the maintainers list)

Link to slack thread: https://drupal.slack.com/archives/CJ93UNJP4/p1634749470426400 (this probably won't be around for much longer since history in the Drupal slack is not preserved)

5d
alison:bi-heart:  Hi folks!  At some point in the past, someone created a 2.x branch on the project I now maintain -- it hasn't been committed to in quite a while, we're just using the 1.x branch -- and there are no commits on 2.x that aren't on 1.x.  Fortunately, the 2.x branch is not mentioned on the project page.
Is it ok if I simply delete the branch...............? (edited) 

5d
alison:bi-heart:  https://www.drupal.org/project/nodeaccess
https://git.drupalcode.org/project/nodeaccess/-/tree/8.x-2.x (edited) 

5d
dww  If there’s a -dev release pointing to it, you can’t delete the branch. If not, and there’s no difference, sure, you can delete it.

5d
alison:bi-heart:  Gotcha, no -dev release pointing to it -- awesome, thank you!

5d
mxh  I’m having a similar situation, and someone actually created a -dev release on it, so I cannot delete that useless branch. The guy who created this branch also was someone suddenly having maintainer permissions on this project, without any pre-notification to me (I am the author of this module and also still an active maintainer of it). The project is this one: https://www.drupal.org/project/imagepin

5d
mxh  TBH this was not something positive for me as this came by total surprise, and the “maintainer” also added untested commits and created new releases that broke stuff that I had to take care of. As a conclusion and after several weeks still not responding to my questions asked in the issue queue regards the created 2.x branch, I decided to remove him from the maintainer list.

5d
alison:bi-heart:  Oh my goodness, I just realized the 8.x-2.x branch was created from 7.x-1.x :pika-facepalm:
So technically, there are commits on it that aren't on its parent branch, but there's still no -dev release connected to this branch...

5d
alison:bi-heart:  I created posterity_8.x-2.x, and deleted 8.x-2.x -- because, yikes, so confusing, and also so 8.x-2.x is available to user later........ (even if we go to semantic versions, having 2.0.0 and 8.x-2.x hanging around would be, y'know, awful)

5d
alison:bi-heart:  @mxh oof that's a nightmare :confused:

5d
dww  Oooof and a new release for every commit, it seems. Yikes. How did they become a maintainer? (edited) 

5d
mxh  I don’t know how they became a maintainer, didn’t take the time to investigate.

4d
cweagans  @mxh hi, when did this happen? (edited) 

3d
mxh  Few months ago - I’d also like to note here that I’m not intending to start a debate regards this case. It was an unfortunate situation that took time and could have even brought even worse consequences for me (e.g. by losing a client), but things didn’t get that far, so I decided not to waste more time on this.

1d
cweagans  Totally understand. I would like to investigate a bit and see how that would have been possible. People just randomly getting maintainership over a project on Drupal.org represents a fairly major security issue from my standpoint. @mxh did you report this to anyone at the time that it happened? And can you please DM me the name of the user who became a maintainer if you have it handy?

10h
mxh  @cweagans I appreciate your interest in this one, though I’m afraid that it could get to even more time to be wasted, and I do not want to generate trouble for people who might somehow be related with that problem but are in fact not directly responsible for it. I decided to not investigate any further at that time, thus I also didn’t report it to anyone. The problems that raised up were reported in the issue queue of the above linked project, so if you’d want to investigate further, this place is a good starting point. One important thing to note is: In the issue queue of that module, there is no issue that requests co-maintenance for this project. Some other notes: The project was on a “Seeking co-maintainer” state once, as I was looking for someone who could’ve joined to maintain this project (but using the standard appliance process for it). Another note is that this project already has further maintainers other than me, and it was me who added them, and I know all of them, so I highly doubt - though not completely to be excluded - that anyone of them added the person that suddenly committed non-reviewed stuff.