That's correct. I did not discover vulnerabilities in existing libraries or add backdoors to any of them. :)
The attack scenario described in the post is (1) attacker writes some plausible-looking patches to an existing library like jQuery, (2) attacker convinces library maintainer to merge the patches, (3) someone builds the library with a buggy minifier, which creates the actual backdoor.
Could somebody please confirm or invalidate my understanding, that this backdoor is just exploitable in addition with other (severe) issues?
An attacker would have to have the ability to tailor/manipulate JS scripts which should be under control of the victim?
Or am i mistaken?