Iirc the specific reason behind this is
- sudo by default requires a tty to run
- vim’s bang spawns a tty to execute commands
- nvim’s bang executes the command directly, then pipes the output to nvim
As a result, sudo (without args) can’t work in nvim as it doesn’t have a tty to prompt the user for passwords. Nvim also used to do what vim did, but they found out spawning the tty was causing other issues (still present in vim) so they changed it.
According to this post, the person involved exposed a different name at one point.
https://boehs.org/node/everything-i-know-about-the-xz-backdoor
Cheong is not a Pingyin name. It uses Romanization instead. Assuming that this isn’t a false trail (unlikely, why would you expose a fake name once instead of using it all the time?) that cuts out China (Mainland) and Singapore which use the Pingyin system. Or somebody has a time machine and grabbed this guy before 1956.
Likely sources of the name would be a country/Chinese administrative zone that uses Chinese and Romanization. Which gives us Taiwan, Macau, or Hong Kong, all of which are in GMT+8. Note that two of these are technically under PRC control.
Realistically I feel this is just a rogue attacker instead of a nation state. The probability of China 1. Hiring someone from these specific regions 2. Exposing a non-pinying full name once on purpose is extremely low. Why bother with this when you have plenty of graduates from Tsinghua in Beijing? Especially after so many people desperate for jobs after COVID.