@portaloffreedom There are actual contraints to the exploit, so the real number of target is unclear unless the analysis is complete. Still, having a package built by a malicious attacker doesn't look too good, even Arch suggested to patch: https://archlinux.org/news/the-xz-package-has-been-backdoored/

> source is still available, from the website

Yes it is (https://git.tukaani.org/?p=xz.git;a=summary) , but the operations are mostly performed in GitHub (the original attacker had access only to it, so inspecting the repo could give additional info on the attacker OpSec but is now gone for good)

> we only found about the backdoor because it's open source. Corporate software is much more opaque.

Indeed this is good, I am not against open source at all, this backdoor was a big issue on the supply chain management