A sockpuppet account is a fake online identity that someone controls to deceive others. Several are often run together to make one person’s agenda look like genuine, independent support. Sockpuppets are used to manipulate reviews, forum discussions and votes. In open source they can manufacture apparent community demand, which pushes maintainers into decisions they might not otherwise make.
So what? Sockpuppets can turn social pressure into a delivery mechanism for an attack. In the xz case, they formed part of the plan to persuade Linux distributions to pick up and ship a backdoored release.
Examples: During the xz Utils attack, apparently unconnected accounts complained about slow progress and pressured the maintainer to share control of the project. Later, other accounts urged distributions to update to the compromised version.
