Here's my suggestions for "lessons learned" from the xz attack:

* Upstream code should be pulled from the git, not some random tarball
* All requests to disable valgrind, memory sanitation etc. in tests should be met with extreme scepticism and caution
* We need to call out people bullying open source maintainers
* We need to find ways to support maintainers before they burn out
* We need to establish a culture of succession for open source maintainers