XZ Utils - the supply chain with no supplier

XZ Utils is a compression library, unglamorous and everywhere: nearly thirty thousand Debian and Ubuntu packages depended on it. In February and March 2024 two of its releases carried a backdoor that would have allowed anyone holding a particular private key to run commands on affected machines through OpenSSH. It was caught weeks before it reached the stable releases of the major distributions.

The attack began around 2021 and it targeted a person rather than a system. An account contributing under the name Jia Tan built up genuine technical credibility over two years. Meanwhile other accounts appeared on the project's mailing lists complaining that the maintainer was slow, that the project was neglected, that a co-maintainer was needed. The maintainer, a volunteer dealing with burnout, eventually granted commit access and then co-maintainer status. The vulnerability that was exploited was human exhaustion, and there is no technical control that addresses it.

The technical design deserves the same attention. The malicious code was never committed to the repository. It lived in the release tarball - the packaged archive that distributions actually build from - hidden in binary files presented as deliberately corrupt compression test cases, activated by obfuscated changes to a build script that ran only during a distribution-style package build and not from a clean checkout of the source. Anyone reviewing the code would have reviewed the wrong artefact. The gap between what is read and what is built is where this lived.

It was found because a Microsoft engineer benchmarking a database noticed that logging in over SSH was taking five hundred milliseconds instead of one hundred. Not a scanner, not a review board, not a security programme: half a second of unexplained latency, and somebody who chose to spend a few hours on it. The test and measurement article in this catalogue argues that the discipline's product is a number somebody would rather not hear. This is the case where the number was half a second and the somebody was a state-grade adversary.

For the taxonomy of supplier compromise this adds a fifth route to the four the Cisco entry sets out, and it is the one with no supplier in it. Nobody was paid, no contract was breached, no company could be sued or audited or excluded from a procurement list. The dependency was maintained by a volunteer, for free, because it needed to exist. That is the actual condition of a great deal of infrastructure, and the incident should be read less as a warning about one library than as a description of the arrangement everything else is built on.