can't get over how supposedly ‘1 developer’ spent ~2.5 years building trust as a maintainer of xz-utils (a compression lib thats on basically every linux machine, yet was shockingly maintained by just 1 person), used sock puppet accounts to pressure that burnt-out maintainer into handing over control, and the only reason the backdoor got caught is that a Microsoft engineer noticed SSH logins were taking ~500ms longer than usual and decided to investigate

thankfully it was caught a few weeks before it would have shipped in stable releases of Fedora and Ubuntu, so not many machines ever ran it, but still, that’s a scary close call