Yes. The relevant points are that Catfriend’s repo was fully reset, no git history, multiple times this year, supposedly because of sensitive data that was mistakenly checked in. If that’s the case, it might explain why shortly before Catfriend deleted his repo, he created an issue saying something along the lines of ‘stop messing with my desktop’, which could be read as a plea to hackers. The repo went dark, and someone else published it, with Catfriend’s private signing key, which triggered automatic updates for some users, without them knowing the maintainer changed. They also claim to have Catfriend’s github credentials. After staying quiet for a month, Catfriend recently posted on the syncthing forum saying that everything is dandy with the new maintainer, without addressing major concerns. Meanwhile, the new maintainer has made large changes to the codebase without public comments. The last two updates from the new maintainer have been reviewed independently, and reproducible builds are enabled to ensure the apk matches the sources. However, that is assuming that Catfriend’s repo was safe to begin with. In the case of ongoing blackmail, malicious code could have been added during one of the repository resets, or in a large refactor commit.

The sad part is that Catfriend picked up this repo after Syncthing deprecated it, just for his friends and family. I don’t think he is a professional developer, and he very obviously was overwhelmed by the project. Syncthing is a very juicy target for malicious state actors, and trust is crucial. I feel awful to say that I no longer trust Catfriend or his replacement, but the circumstances don’t inspire confidence.