The malicious developer did not add bugs to xz, they used xz as an attack vector. They added malicious shell code to the xz build scripts, so that when you buil

The malicious developer did not add bugs to xz, they used xz as an attack vector. They added malicious shell code to the xz build scripts, so that when you build and install xz it attempts to inject a backdoor into sshd. The malicious shell scripts were carefully hidden. They were compressed and added to the repository under the guise of "test files". Furthermore, the backdoor is only enabled in the release tarballs: the malicious actor has run the autoconf and then manually enabled the backdoor in the generated build scripts. If you clone the upstreaf repo and regenerate the buildscriots from scratch,the backdoor is not enabled.