The XZ Utils Backdoor: How a Supply Chain Attack Hid Outside Git

CVE-2024-3094 was not just a backdoor. It was a two-year infiltration campaign that exploited a structural blind spot in how open source software is actually distributed. The malicious code was never committed to git at all. In March 2024, Andres Freund, a Microsoft engineer, noticed that SSH logins on his Debian testing machine were taking about 500ms longer than expected and consuming anomalous…