CVE-2024-3094
CVSS 10 CRITICAL: malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. EPSS 86% (100th percentile).
Vulnerabilities & Exploits · Supply Chain
Unit 42 used XZ Utils as the clearest example in a broader supply-chain warning: attackers can compromise the upstream source tarball itself, so malicious code arrives before a project ever reaches application scanning or production controls. The XZ case is tracked as CVE-2024-3094.
The mechanism is simple and dangerous. If a CI system or developer pulls a trusted release archive and builds from it, any backdoor hidden in that archive gets compiled in as if it were legitimate source. That means the compromise can spread into many downstream builds, even when the application layer looks clean.
For teams that build from third-party source tarballs or package sources, the exposure sits in the toolchain and the artifact, not just in deployed software. Once that trust boundary is crossed, normal dependency checks may be looking too late in the chain.
1 source · Aug 22
CVSS 10 CRITICAL: malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. EPSS 86% (100th percentile).
Unit 42
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls
originalPart of the PlainSec briefing for 2026-08-22
Every edition of this story: XZ Utils Showed Build Inputs Are Part of the Attack Surface