Is xz-utils compromised? The CVE-2024-3094 backdoor and your Article 14 clock

What happened

In March 2024, malicious code was discovered in xz-utils 5.6.0 and 5.6.1 — the liblzma compression library used across the Linux ecosystem. The backdoor was introduced not by an external exploit but by a maintainer account that had gained trust over time and then shipped obfuscated malicious code in the release tarballs, targeting SSH authentication on affected systems.

It was caught almost by accident: a developer investigating a small performance regression noticed anomalous behaviour and disclosed it publicly. See the primary sources above — the NVD entry, the CISA advisory, and the original oss-security disclosure.

Why this is the archetypal Article 14 trigger

This is exactly the class of event that puts a manufacturer on a 24-hour clock the fastest, and the class a CVE-only detection feed cannot warn you about in time:

• The malicious code was shipped in official releases before any CVE existed.
• The trigger was an upstream compromise / ownership change, not a vulnerability someone found in your own code.
• By the time CVE-2024-3094 was assigned, the affected versions were already in distributions and builds — the warning came after the exposure, not before.

If a package you ship had gone the way xz-utils did, your Article 14 clock would have started at the moment you became aware of the compromise — and the only fact that would matter later is when that was, recorded and timestamped.

Check your own dependencies

The free readiness report scans a manifest you paste for exactly this class of signal — abandoned, unmaintained, and ownership-changed packages alongside known-exploited ones — and shows your 24-hour exposure with no email and nothing stored.