An anonymous reader quotes a report from BleepingComputer: Open source project Moq (pronounced “Mock”) has drawn sharp criticism for quietly including a controversial dependency in its latest release. Distributed on the NuGet software registry, Moq sees over 100,000 downloads on any given day, and has been downloaded over 476 million times over the course of its lifetime. […] Last week, one of Moq’s owners, Daniel Cazzulino (kzu), who also maintains the SponsorLink project, added SponsorLink to Moq versions 4.20.0 and above. This move sent shock waves across the open source ecosystem largely for two reasons — while Cazzulino has every right to change his project Moq, he did not notify the user base prior to bundling the dependency, and SponsorLink DLLs contain obfuscated code, making it is hard to reverse engineer, and not quite “open source.”
“It seems that starting from version 4.20, SponsorLink is included,” Germany-based software developer Georg Dangl reported referring to Moq’s 4.20.0 release. “This is a closed-source project, provided as a DLL with obfuscated code, which seems to at least scan local data (git config?) and sends the hashed email of the current developer to a cloud service.” The scanning capability is part of the .NET analyzer tool that runs during the build process, and is hard to disable, warns Dangl. “I can understand the reasoning behind it, but this is honestly pretty scary from a privacy standpoint.”
SponsorLink describes itself as a means to integrate GitHub Sponsors into your libraries so that “users can be properly linked to their sponsorship to unlock features or simply get the recognition they deserve for supporting your project.” GitHub user Mike (d0pare) decompiled the DLLs, and shared a rough reconstruction of the source code. The library, according to the analyst, “spawns external git process to get your email.” It then calculates a SHA-256 hash of the email addresses and sends it to SponsorLink’s CDN: hxxps://cdn.devlooped[.]com/sponsorlink. “Honestly Microsoft should blacklist this package working with the NuGet providers,” writes Austin-based developer Travis Taylor. “The author can’t be trusted. This was an incredibly stupid move that’s just created a ton of work for lots of people.” Following the backlash, Cazzulino updated the SponsorLink project’s README with a lengthy “Privacy Considerations” section that clarifies that no actual email addresses, just their hashes, are being collected.
