XZ Utils Backdoor: How a Near-Catastrophic Linux Supply Chain Attack Was Caught

In late March 2024, Microsoft engineer Andres Freund accidentally discovered a sophisticated backdoor hidden in XZ Utils, a widely used compression library present on most Linux and macOS systems, tracked as CVE-2024-3094. Freund noticed unusual CPU spikes and SSH login delays on his Debian system, which led him to trace the cause to a malicious, heavily obfuscated payload embedded in the liblzma component during the build process. The backdoor was designed to allow an attacker with a specific private key to bypass authentication and execute arbitrary code with root privileges on affected servers running systemd-patched SSH daemons. The attack was orchestrated over nearly three years by an actor using the alias 'Jia Tan,' who systematically built trust within the XZ project while coordinated fake accounts pressured the original maintainer, Lasse Collin, into ceding control. The incident has raised urgent questions about the security of open-source supply chains and the sustainability of relying on under-resourced volunteer maintainers for critical software infrastructure.