> It doesn't matter. To understand the exact behavior and extend of the backdoor, this does matter. An end to end proof of how it works is exactly what was nee

> It doesn't matter. To understand the exact behavior and extend of the backdoor, this does matter. An end to end proof of how it works is exactly what was needed. > A way to check if servers are vulnerable is probably by querying the package manager Yes, this has been know since the initial report + later discovering what exact strings are present for the payload. https://github.com/Neo23x0/signature-base/blob/master/yara/bkdr_xz_util_cve_2024_3094.yar https://github.com/Neo23x0/signature-base/blob/master/yara/b... > Not very sophisticated, but it'll work. Unfortunately, we live in a world with closed-servers and appliances - being able as a customer or pen tester rule out certain class of security issues without having the source/insights available is usually desirable.