In march 2024, a microsoft engineer named andres freund noticed something odd, postgresql was running slightly slower than it should. ssh logins were taking a fraction of a second longer than expected. What he found when he dug in: someone had spent two years infiltrating the open source project that maintains xz utils, a compression library so foundational it ships inside almost every linux distribution on the planet and they had hidden a backdoor in it. the attacker operated under the name "jia tan." starting in 2021, jia tan began contributing to the xz project, fixing bugs, submitting patches, building a reputation. patient, methodical, consistently helpful, over roughly two years, jia tan gained the trust of the project's maintainer, a solo developer who had been showing signs of burnout. Other accounts suspected to be part of the same operation applied social pressure, complaining the maintainer was too slow and suggesting jia tan should get more responsibility. Eventually jia tan was given commit access, ability to push code directly into the project. the backdoor was embedded in the build process not in the main source code where reviewers would look, but in test files and scripts that only activated under specific conditions: a debian or red hat linux system, built for release, with systemd running. it was designed to intercept ssh authentication, the protocol used to remotely access servers and allow anyone with a specific private key to bypass authentication entirely. the target was effectively the infrastructure of the internet. ssh is how engineers access servers. the affected linux distributions power a significant fraction of the world's web servers, cloud infrastructure, and enterprise systems. if the backdoor had shipped in stable releases and propagated normally, the attacker or whoever they were working for would have had a quietly exploitable path into an enormous number of systems globally. Freund reported it. the package was pulled. the versions containing the backdoor, xz 5.6.0 and 5.6.1 were caught before they reached stable linux releases at scale.