No official vsftpd developer has ever published a “fix” for 2.0.8 on GitHub, because that would imply the original 2.0.8 was legitimate – which it wasn’t.

: The backdoor is activated when a user attempts to log in with a username that ends in a smiley face sequence, :) .

If you must examine exploit code for research:

Recommended permanent fixes

In , attackers compromised the official vsftpd download server at beasts.org . They replaced the legitimate vsftpd-2.3.4.tar.gz with a backdoored version. This malicious copy was then mirrored by several major Linux distributions for a short window of time.