State-sponsored hackers inject malware into "XZ" library

[blue_devil]

Originally Posted by chants

Makes you wonder how many other open source projects are backdoored but noone noticed or investigated. Kind of scary.

This is what I am talking about

If you are interested in state-sponsored-hackers. You should also read how Ken Thompson injected a virus to a compiler.

https://wiki.c2.com/?TheKenThompsonHack

From the article: "Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus."