Incident brief
On March 29, 2024, Andres Freund posted his findings to the oss-security list after investigating unusual SSH login behavior on Debian development installations. He identified a backdoor in upstream xz/liblzma release material, including versions 5.6.0 and 5.6.1. His message distinguished files in distributed tarballs from what a reader might see in the main repository. That distinction is the central archival fact: a code-review view of a repository was not identical to the artifact a distribution might build and ship.
How the evidence developed
Freund described suspicious build-time behavior and the conditions under which the altered library could affect SSH service behavior. This was an initial technical disclosure, with caveats and follow-up investigation still ahead. It should not be paraphrased into a claim that the backdoor reached every Linux server, or that all systems using compression libraries were compromised. The discoverer's own observations explain why the issue was found; they do not measure global deployment. The exact naming and attribution of those behind the change are separate questions not established by this initial message.
Defensive reading
Package consumers need to distinguish the repository commit, signed release, release tarball, distro package and installed binary. Check which version and artifact actually entered an environment before declaring exposure. Maintainers and distributors can compare generated release archives against reproducible expectations, review build scripts and investigate anomalous performance or test failures rather than dismissing them as noise. Incident response should preserve a suspect package and its provenance while moving supported systems to trusted releases under vendor guidance. A software bill of materials is useful only if it points to the artifact that truly ran.
What remains bounded
This account does not reproduce the mechanism or provide an exploitation recipe. It cites a first-hand public disclosure, not a retrospective attribution report. The durable lesson is about evidence surfaces: the path from source control to a production binary contains transformations and trust decisions, each of which can alter what the final user receives.