XZ Utils backdoor — three years of social-engineering supply chain attack

A multi-year social-engineering campaign installed a backdoor in xz-utils, a compression library used indirectly by OpenSSH on most Linux systems. Discovery was accidental — a Microsoft engineer noticed a 500ms SSH connection delay.