Is this what you're referring to? > Regarding sshd authentication bypass/code execution > Arch does not directly link openssh to liblzma, and thus this attack

Is this what you're referring to? > Regarding sshd authentication bypass/code execution > Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command: > However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist. https://archlinux.org/news/the-xz-package-has-been-backdoored/ https://archlinux.org/news/the-xz-package-has-been-backdoore... I'm not finding anything from Arch mentioning dpkg/rpm, the linked article above is the latest article about the xz compromise from the Arch homepage.