One of the more interesting graphics I've seen regarding the XZ backdoor is a representation of Jia Tan's commits over time. Notice how the commits in question were done well outside the normal times this user committed code in the past.

Does this lend credence to the notion that somehow the Jia Tan account was hijacked? Maybe. Or maybe it just means the attackers got sloppy at the tail end of a 2 year op for unknown reasons, like they were up against a hard deadline that was tied to something happening IRL.

I'm curious what the prevailing theory is here.

I was somewhat able to follow along here, but I got lost a few times. Does this mean we think Libarchive also was also messed w/ by the XZ backdoor bandits?

https://github.com/libarchive/libarchive/pull/1609

Added error text to warning when untaring with bsdtar by JiaT75 · Pull Request #1609 · libarchive/libarchive

Added the error text when printing out warning and errors in bsdtar when untaring. Previously, there were cryptic error messages when, for example in issue #1561, the user tries to untar an archive...

GitHub
@briankrebs I am going to throw my hat into the ring for this being a smoke test for how much scrutiny random minor changes receive, because it’s clearly a regression even if it doesn’t necessarily introduce a new vuln, and is easily deniable as being an innocent mistake if someone does complain.