content: Your code is already shared with the entire world, by design.  To me, this is the issue. It's a perfect attack vector for backdoors if a bad actor controlled it.  Think about how many software packages are hosted by Github. Developers around the world use these libraries in their own other bits of software in websites and systems around the world. If the CIA gains the ability to target users and inject code they want into various repos, it would be hard to detect it and give them a way to spread their backdoors into tons of machines. For instance, if they can identify that the developer at IP address XYZ is a person they want to spy on or has some connection to somebody they want to spy on, they can allow him to download a special version of a software library he uses and get it on his server and the CIA can give themselves a backdoor. Even comparing the repos hash to the files downloaded isn't necessarily foolproof if the CIA controls what hash they give you to check against in the first place. If the CIA controlled the system, they could do this on an individual level and it would be very hard to detect and the wider open source community wouldn't even be able to easily catch this. Of course, this is just a guess: I have no proof that the CIA/NSA is planning this type of thing. It could just be Microsoft's attempt to buy goodwill among the developer community: which they depend on over the long-run. But given how shady the government has been with this type of stuff...who knows what their real goal is...