Skip to content

XZ Utils backdoor

Named by 4 kept items in this workspace.

Search every workspace for XZ Utils backdoor. It matches the name as written, so it can find other things that share it.

The items that name it 4

  • Spectrmachina/Ztrust
    repo2026-10-22It is written here as xz-utils backdoor (cited as an example of a supply-chain compromise).

    cited as an example of a supply-chain compromise

  • Securing Docker images
    article2026-08-28It is written here as xz-utils backdoor.

    A backdoor in the xz-utils compression library, which ships inside most Linux base images. It lived in two specific releases, 5.6.0 and 5.6.1; teams still on the older 5.4 line were never exposed. CISA's guidance afterward was to downgrade, not upgrade.

  • Dependency Confusion: How Attackers Poison Your Build | Blog | Endor Labs
    article2026-07-29

    In 2024, followed two years of trust-building contributions before the payload went in

  • Pantheon-Security/medusa
    repo2026-05-10

All threat actors in this workspace.