XZ Utils backdoor attempted supply chain compromise
A malicious maintainer nearly succeeded in inserting a remote-code-execution backdoor into XZ Utils, a critical Linux compression library, via social engineering; discovered before widespread deployment.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
In March 2024, a sophisticated supply-chain attack targeted XZ Utils, an open-source data compression utility widely used in Linux distributions. The attacker, using the account JiaT75, spent years contributing to the project and systematically pressured the original maintainer into granting co-maintainer status. Once elevated, the attacker replaced the original maintainer's contact information on oss-fuzz, a vulnerability scanner, and introduced malicious code into versions 5.6.0 and 5.6.1 that would have enabled remote code execution on affected systems. The backdoor was discovered by a Microsoft engineer before it reached major Linux distributions; had it propagated, it would have compromised hundreds of millions of networked systems including cloud infrastructure worldwide.
The attack exploited open source's structural vulnerabilities: critical projects maintained by single, under-resourced individuals; reliance on trust within volunteer communities; and minimal vetting controls compared to proprietary software. This marks the first deliberate attempt to introduce malicious code into a widely-deployed OSS library, distinguishing it from historical accidental vulnerabilities like Heartbleed or Log4Shell. The attacker employed social engineering, cyber-bullying, and patience to achieve maintainer access, then concealed the malicious commits in the build system while disabling existing security checks.
Defenders should treat this as a wake-up call for supply-chain risk management. XZ Utils versions 5.6.0 and 5.6.1 were affected; users must downgrade to version 5.5.3 or earlier. The open-source model's transparency enabled detection before harm, but the incident demonstrates that critical infrastructure components now face state-level or sophisticated threat-actor targeting. Organizations must audit their dependencies, implement code-review and build-pipeline security, and support the maintainers of critical open-source projects they rely upon.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-the-xz-backdoor-trust-and-open-source-software
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs