Two years of trust, one backdoor: what the XZ-Backdoor teaches us about supply chain risks
Two years of unremarkable contributions, then a backdoor with root privileges. The XZ-Backdoor case shows how vulnerabilities reach production through routine updates, and which CRA obligations then apply.




