Loading story…
A supply-chain backdoor tracked as CVE-2024-3094 was inserted into upstream XZ Utils/liblzma release tarballs after the Jia Tan/JiaT75 persona spent years gaining contributor trust and commit access. Malicious build-time changes could, under narrow conditions, alter liblzma symbol resolution during OpenSSH public-key authentication, allowing attacker-controlled code to bypass authentication and obtain system-level SSH access with a specific key. Researcher Andres Freund uncovered the compromise after investigating anomalous SSH performance on Debian Sid.
The affected code reached development and pre-release channels, including Debian testing/unstable and Fedora Rawhide, but not stable production releases. The incident highlights the exposure created by lightly maintained open-source dependencies and social pressure directed at volunteer maintainers; organizations should inventory dependencies through SBOMs, assess project health and maintainer-access risks, analyze transitive dependencies, and favor supported stable/LTS releases for production systems.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
Security researcher Andres Freund discovered the XZ/liblzma supply-chain backdoor after investigating unusually high sshd CPU usage during logins and Valgrind errors. The vulnerability was designated CVE-2024-3094.
A contributor using the JiaTan/JiaT75 persona joined the XZ project and began making contributions. The persona also built a history of contributions across open-source projects while gaining influence over XZ.
The event-stream npm compromise was discovered after Jayden Seric reported an unexpected package-deprecation warning and Node.js bootstrap error. A malicious flatmap-stream dependency added by maintainer right9ctrl contained obfuscated cryptocurrency-stealing code.
Elastic released YARA signatures, detection rules, and osquery queries to identify the XZ/liblzma backdoor and affected package versions. Elastic Defend deployed the Linux.Trojan.XZBackdoor YARA rule, and Elastic published an EQL behavioral detection for suspicious sshd child-process activity associated with simulated backdoor execution.
CISA advised organizations to downgrade XZ Utils to a version earlier than 5.6.0 and investigate systems on which affected releases had been installed for suspicious activity.
The compromised XZ code was incorporated into development or unstable channels including Debian Sid, Debian testing (trixie), Fedora Rawhide, and unstable releases associated with Red Hat, openSUSE, Kali, Arch, and Ubuntu. The affected channels were not stable production releases.
The compromise introduced obfuscated build-time logic into distributed XZ/liblzma source tarballs, modifying build artifacts and runtime symbol resolution. Under narrow conditions, it could redirect OpenSSH public-key authentication processing and enable an SSH authentication bypass.
After other accounts pressured the original maintainer to expand maintainership, Jia Tan gained author status and independent commit rights; the trust-building process took approximately two years. The original maintainer had reported social and mental-health difficulties.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourceelastic.co
Open sourcenodejs-security.com
Open sourcewiz.io
Open sourceaccess.redhat.com
Open sourcegithub.com
Open sourcetukaani.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious backdoor in **XZ Utils** versions `5.6.0` and `5.6.1` was identified as **CVE-2024-3094`, with the tampering found in upstream release tarballs rather than the public Git repository. The compromised code targeted Linux distributions that linked `liblzma` into patched `sshd` builds, creating conditions for remote unauthorized access through `systemd`-managed SSH authentication. Red Hat said affected packages appeared in **Fedora Rawhide** and **Fedora 40 beta**, while **RHEL** was not impacted, and it also cited evidence of successful malicious builds in **Debian unstable (Sid)**. Further analysis indicated the intrusion was a long-running open-source supply-chain operation tied to the contributor alias **Jia Tan**, using staged shell scripts and modified object files to activate malicious functionality during the build process. SentinelOne reported that `5.6.1` introduced a more modular mechanism capable of loading payloads from binary test files, suggesting the actor planned to add further vulnerabilities over time, and noted a suspicious February 2024 commit affecting LandLock as a possible sign of broader tampering. Vendors urged users to stop using affected Fedora builds and downgrade or revert to **XZ 5.4.x** while distributions investigated exposure and published recovery guidance.
Aug 31, 2026
A malicious supply-chain backdoor was discovered in **XZ Utils** versions `5.6.0` and `5.6.1`, tracked as **`CVE-2024-3094`**, after PostgreSQL developer and Microsoft engineer **Andres Freund** investigated unusual CPU behavior and traced it to `liblzma`. The tampering was hidden in release tarballs rather than plainly visible in the main Git repository, using an obfuscated **M4 macro** during the build process to generate second-stage artifacts that altered library behavior. Researchers and vendors said the poisoned build could interfere with **OpenSSH** authentication through `systemd`, creating a path for unauthorized remote access to affected Linux systems. Red Hat said **Red Hat Enterprise Linux** was not affected, but compromised packages reached **Fedora Rawhide** and **Fedora Linux 40 beta**, prompting urgent downgrade and rollback guidance to safe `5.4.x` releases; Fedora 40 reportedly did not show successful execution of the injected code. Reports also said the malicious build succeeded in **Debian unstable (Sid)**, appeared in a Debian beta branch, affected several **openSUSE** distributions, and was noted by **Kali Linux**, while stable Debian releases were not known to be impacted. The incident was widely described as a near-catastrophic attack on Linux infrastructure, with scrutiny falling on maintainer account **Jia Tan / JiaT75** and an apparent long-running social-engineering effort to gain influence over the project.
Jun 29, 2026
A malicious backdoor was discovered in **XZ Utils**, a widely used compression library, and assigned **`CVE-2024-3094`**, raising urgent concerns about software supply chain compromise across Linux environments. The tampered code was introduced into upstream release tarballs for versions **5.6.0** and **5.6.1** and could enable unauthorized remote code execution by subverting authentication workflows in systems using affected `liblzma` packages, particularly where `sshd` was linked through `systemd` integrations. Security teams were urged to identify vulnerable builds, downgrade to trusted versions, and verify package provenance across development and production systems. The incident renewed attention on the broader risk posed by foundational open-source components becoming attack vectors, echoing the long-tail impact of major infrastructure flaws such as **`CVE-2021-44228`** in **Apache Log4j**. While unrelated technically, both cases underscored how deeply embedded dependencies can create outsized enterprise exposure when compromised. Organizations were advised to strengthen software bill of materials validation, monitor upstream package integrity, and accelerate patching and rollback procedures for critical third-party libraries.
Jul 12, 2026