3 ms·

Note the malicious m4 build scripts were not checked into git, but only put in the released tar balls. You can see the original content here: https://salsa.deb

• throwaway4good 3y ago
  The test file containing the backdoor seems to be here: https://git.rootprojects.org/root/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89 https://git.rootprojects.org/root/xz/commit/6e636819e8f07033...
  • deng 3y ago
    Yes, the binary "test files" were checked in. But the code that actually decompresses and executes the shell code in that file is in this m4 script, which only exists in the tar archive: https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0-0.2/m4/build-to-host.m4 https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0...