[ilvez]

Or they just bought the guy at one point, because I understood the malicious behaviour started quite recently.

[timschmidt]

Jia Tan's very first commit two years ago made suspicious changes to liblzma. See the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdo...