liblzma

XZ Utils Backdoor: A Technical Deep Dive

How a two-year-long social engineering effort inserted a backdoor into xz/liblzma's release tarballs, and how a Postgres developer's curiosity about slow SSH logins caught it.