upvote
There shouldn't be any interface admins as such. There should be an enforced review process for changes to global JavaScript so stuff like this can't happen.

I'm sure there are Google engineers who can push changes to prod and bypass CI but that isn't a normal way to handle infra.

reply
reply
Those are the English Wikipedia-only users, but you also need to include the "global" users (which I think were the source of this specific compromise?). Search this page [0] for "editsitejs" to see the lists of global users with this permission.

[0]: https://en.wikipedia.org/wiki/Special:GlobalGroupPermissions

reply