# xz-utils Incident

The reference incident for supply-chain attacks executed via maintainer-trust capture rather than credential theft. Discovered by Andres Freund (Microsoft) in late March 2024 when investigating SSH login latency, traced to a backdoor in the `liblzma` library shipped as part of `xz-utils`.

The high-level shape:

- The xz-utils project had a single, increasingly burnt-out maintainer (Lasse Collin). Public mailing-list posts over years showed unanswered issues, pressure from "contributors" asking for releases, and pressure from "users" complaining about staleness. (See [[unmaintained-scanner-pressure]] for the structural pattern.)
- An identity calling itself "Jia Tan" (account `JiaT75`) appeared in 2022, made plausible contributions for ~2 years, gradually accumulated trust, and was eventually granted co-maintainer status with release authority.
- Other personas ("Jigar Kumar," "Dennis Ens") wrote pressure-applying posts to the mailing list during the same period, demanding Lasse hand off control. These were strongly suspected to be the same actor or a coordinated team.
- In early 2024, Jia Tan landed a series of commits that — through obfuscated build-system modifications hidden inside test-case binary files — inserted an SSH-server backdoor that triggered on specific cryptographic key material.
- The backdoored release (xz 5.6.0 / 5.6.1) made it into Debian unstable, Fedora rawhide / 40 beta, and openSUSE Tumbleweed before Freund's detection caught it.

What makes xz-utils the canonical reference, not just a notable incident:

- **The attack and a legitimate maintainer transition were indistinguishable from outside** for roughly two years. Every signal that a "concerned downstream user" might use to verify the new maintainer was actually present (good code, prompt responses, mailing-list activity, conference attendance) was satisfied.
- **The social-engineering layer was the load-bearing part.** No CI compromise, no token theft, no registry takeover. The attacker became a maintainer in the legitimate way and then committed legitimate-looking code.
- **The forcing-function dynamic was visible.** Pressure for a release that wasn't ready was part of how Lasse was worn down into accepting help.

The incident reset the entire community's read of "new maintainer steps in" events. Before xz, a fresh contributor doing the work the original maintainer didn't have time for was unremarkable. After xz, it is the exact pattern of a documented attack, and downstream users now treat it with suspicion — see [[maintainer-governance-ambiguity]] for the cost of that shift.

## See also

- [[supply-chain-security]]
- [[maintainer-governance-ambiguity]] — why ambiguous transitions now read as attacks
- [[unmaintained-scanner-pressure]] — the forcing function that helped wear Lasse down
- [[fsnotify-maintainer-dispute]] — a 2026 case that benefited from post-xz vigilance even though it wasn't an attack