[toast0]

Seems unlikely. xz is not a dependency of OpenSSH.

It's only a transitive dependency of sshd on Linux distributions that patch OpenSSH to include libsystemd which depends on xz.

It's wholy unreasonable to expect OpenSSH maintainers to vet contributors of transitive dependencies added by distribution patches that the OpenSSH maintainers clearly don't support.

[pdonis]

> It's only a transitive dependency of sshd on Linux distributions that patch OpenSSH to include libsystemd which depends on xz.

Ah, ok. Then my question should really be about the distros--did any of them spot the co-maintainer being added and do due diligence?

As for the "libsystemd" part, there's another reason for me to migrate to non-systemd distros.

[ciupicri]

From https://news.ycombinator.com/item?id=39866275 by rwmj:

> Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo.

> He has been part of the xz project for 2 years, adding all sorts of binary test files, and to be honest with this level of sophistication I would be suspicious of even older versions of xz until proven otherwise.

[cqqxo4zV46cp]

Don’t conflate this with the ongoing trendy systemd hate. There are myriad other attack vectors out there.