In March 2024, a Microsoft engineer noticed that SSH logins on his personal laptop were taking about 500 milliseconds longer than expected. He started digging. What he found was one of the most sophisticated supply chain attacks ever documented — a two-year campaign to insert a hidden backdoor into a library installed on virtually every Linux server on Earth.
TL;DR
- XZ Utils is a compression library present on virtually every Linux system
- A contributor called "Jia Tan" spent about 2.5 years making real improvements to the project, building trust
- Once trusted as a co-maintainer, they inserted a hidden backdoor into the build system
- The backdoor would have let anyone with a specific private key log into any affected server without a password
- Caught just days before reaching stable Debian and Red Hat releases — entirely by accident
- CVE-2024-3094, CVSS 10.0
What is XZ Utils?
XZ Utils provides the .xz compression format — you have used it any time you downloaded a software package as a .tar.xz file. More importantly for this story, it is a low-level library linked into many system components on Linux, including systemd, which most modern distributions use for system management. That linkage was what made the attack viable.
The long game
The project's sole maintainer, Lasse Collin, had been struggling to keep up with the workload alone. In late 2021, a contributor appeared — going by "Jia Tan" — submitting small, high-quality bug fixes. Over the next two years, Jia Tan became more active and more trusted.
Other accounts appeared in the project's mailing list, applying pressure: complaining development was too slow, suggesting Collin should hand off more responsibility. By 2023, Jia Tan had commit access and was effectively running the project.
The backdoor
The malicious payload was hidden in the project's build system, embedded in binary test files that were not stored in the git history in human-readable form. During the build process, it injected code into the compiled library.
On systems where XZ Utils was linked into sshd (the SSH daemon) via systemd — which included most modern Linux distributions — the backdoor intercepted the authentication process. Anyone presenting a specific cryptographic key known only to the attacker would be granted access to the server with no password required.
This was not a flaw in SSH itself. It was malicious code injected into a dependency that SSH happened to load.
How it was caught
Andres Freund, a PostgreSQL developer at Microsoft, noticed that SSH on his Debian testing machine was unusually slow and consuming more CPU than expected during logins. He traced it to liblzma — the XZ Utils library — and published his findings on March 29, 2024.
The malicious versions (5.6.0 and 5.6.1) had made it into Fedora Rawhide, Debian unstable, and several other pre-release distributions. They had not yet reached stable releases of major distributions. The window was days away from closing.
What this revealed
The XZ attack exposed a structural vulnerability in how open-source infrastructure is maintained. Critical projects — used by millions of servers — are often maintained by a single person, unpaid, under real pressure to accept help from strangers.
It also showed that a sufficiently patient attacker can defeat the "many eyes" assumption of open-source security. Nobody reviewed the binary test files. The attack only came to light because someone noticed a 500ms SSH slowdown.
The XZ incident is a reminder that dependency risk is not only about known CVEs — it is about the entire supply chain behind the code you run. Tools that track exactly what versions you are running and alert when something unexpected changes are part of any serious security posture.