Seems the backdoor relied on Debian and others patching their copies of openssh to support systemd notifications, and this would obviously not be the case on Op

Seems the backdoor relied on Debian and others patching their copies of openssh to support systemd notifications, and this would obviously not be the case on OpenBSD. To be sure the current ports version of xz is 5.4.5: https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/archivers/xz/Makefile?rev=1.50&content-type=text/plain https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/a... Although the maintainer was working on updating to 5.6.1, but this news broke before the diff was landed: https://marc.info/?l=openbsd-ports&m=171174441521894&w=2 https://marc.info/?l=openbsd-ports&m=171174441521894&w=2