Unverified50% confidenceFactExact time
The XZ Utils attacker built trust over multiple years to ultimately gain project maintainer privileges and insert malicious code.
1
Sources
50%
Confidence
Long-term
Relevance
9/9/2026
First Seen
Sources
Related Entities
Related Claims
Unverified2023 年 XZ Utils 后门事件揭示了开发工具链的脆弱性，被植入隐蔽行为的工具可在不触发业务告警的情况下在软件供应链中留下持久化痕迹75% similarUnverifiedIn the 2024 xz-utils backdoor incident, the attacker spent two years gaining the trust of maintainers before implanting backdoor code.74% similarUnverified2024 年 XZ Utils 后门事件中，攻击者历时两年渗透项目维护团队植入恶意代码，幸被 Microsoft 工程师 Andres Freund 在性能异常排查中发现74% similarUnverifiedXZ Utils 后门事件中攻击者以'Jia Tan'身份潜伏近两年，逐步获得维护者信任后在压缩库中植入后门72% similarUnverifiedXSS (Cross-Site Scripting) is one of the most common vulnerabilities in web security, and attackers can steal cookies, session tokens, or other sensitive information by injecting malicious scripts.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/881641API
curl https://kongchang.com/api/v1/knowledge/claims/881641MCP
get_claim(id=881641)