NixOS backdoored by trusting-trust attack on GNU strip

A new paper on arXiv shows that Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors every program it builds and reproduces that backdoor when it rebuilds itself, is not actually specific to compilers. The authors construct a complete version of the attack built entirely around GNU strip: a build utility that only removes debugging symbols from finished binaries and never inspects or generates source code. The attack works purely through manipulation of finished ELF files, with no involvement of a compiler at all.

The target is the bootstrap chain of the NixOS Linux distribution. NixOS builds its entire toolchain from a small set of trusted binary seeds. The authors tamper with a single copy of strip inside that binary seed. Once compromised, the payload propagates automatically from one generation of strip to the next as NixOS rebuilds its own tools, and it survives into the distribution's final standard build environment even after the original tampered seed has been removed from the dependency closure, meaning the infected binary is no longer even present as a traceable ancestor.

The authors tested the attack on a real nixpkgs revision rather than a synthetic example. Starting from the single tampered strip, the attack builds a complete graphical installer for NixOS without any build failures, and in doing so backdoors almost every binary the installer comprises, enabling arbitrary malicious behavior in the resulting subverted packages.

The abstract does not name the authors or their institution, and it gives no count or percentage for how many binaries end up backdoored beyond the phrase "almost every one." It also does not say whether NixOS or nixpkgs maintainers have been notified, whether a fix exists, or whether the same technique has been shown to work against other Linux distributions.

Key facts

Researchers built a full trusting-trust attack around GNU strip, a build utility that only touches finished binaries and never reads or generates source code, refuting the assumption that the attack is compiler-specific.
The attack works purely through manipulation of finished ELF files, with no compiler involvement anywhere in the chain.
A single tampered strip planted in NixOS's binary bootstrap seed self-propagates from one generation of strip to the next and survives into the final build environment even after the tampered seed leaves the dependency closure.
On a real nixpkgs revision, the attack built a complete graphical installer with no build failures and backdoored almost every one of its binaries, enabling arbitrary malicious behavior in the subverted packages.
The abstract gives no author names or institution, no exact count of backdoored binaries, and no word on maintainer notification, a fix, or whether other distributions are similarly vulnerable.

Why it matters

Trusting-trust attacks were long treated as a compiler problem: keep the compiler trustworthy, or verify it through diverse double-compiling, and the rest of the toolchain is safe. This paper breaks that assumption by showing the same self-propagating backdoor works through GNU strip, a utility whose entire job is to delete symbols from an already-built binary. If a tool that never touches source code can carry a trusting-trust payload, the attack surface for supply-chain compromise is not the compiler alone; it is every binary utility that runs during a bootstrap.

Who it affects

Most directly, NixOS and nixpkgs, whose reproducible-build bootstrap the paper uses as its real-world demonstration. More broadly, any Linux distribution or build system that bootstraps its toolchain from a small set of trusted binary seeds, and any security team that has treated reproducible or bootstrappable builds as sufficient proof against this class of attack.

How to use it

This is a research disclosure rather than a product or a tool release. The full technical construction is described in the paper itself, available as PDF or experimental HTML on arXiv (2607.24888), submitted 27 July 2026.

How solid is it

The claim is not theoretical: the authors ran the attack against a real nixpkgs revision and report that it built a complete, working graphical installer while backdooring almost all of its binaries. That said, the abstract text available here does not name the authors or their institution, which limits any assessment of provenance beyond the paper's own account of its results.

Risks and caveats

The abstract does not quantify how many binaries end up backdoored beyond "almost every one," does not say whether NixOS or nixpkgs maintainers were notified or whether a fix exists, carries no CVE identifier or disclosure timeline, and does not state whether the technique has been demonstrated against, or is applicable to, distributions other than NixOS.

“GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files.”

— paper abstract, arXiv 2607.24888