some rando gained the trust of the xz maintainer and tried to sneak in a very sophisticated backdoor. luckily caught, but i wonder if we had another project compromised and don’t even know about it.