XZ Utils Showed Build Inputs Are Part of the Attack Surface
Unit 42 used XZ Utils as the clearest example in a broader supply-chain warning: attackers can compromise the upstream source tarball itself, so malicious code arrives before a project ever reaches application scanning or production controls. The XZ case is tracked as CVE-2024-3094.
The mechanism is simple and dangerous. If a CI system or developer pulls a trusted release archive and builds from it, any backdoor hidden in that archive gets compiled in as if it were legitimate source. That means the compromise can spread into many downstream builds, even when the application layer looks clean.
For teams that build from third-party source tarballs or package sources, the exposure sits in the toolchain and the artifact, not just in deployed software. Once that trust boundary is crossed, normal dependency checks may be looking too late in the chain.