The XZ Utils backdoor, discovered last week, and the Heartbleed security vulnerability ten years ago, share the same ultimate root cause. Both of them, and in fact all critical infrastructure open source projects, should be fixed with the same solution: ensure baseline funding for proper open source maintenance.
So am I understanding correctly that this code wasn’t exactly handled as a normal team? Like XZ had one person vetting the replacement?
That’s not hugely uncommon in the open source world. An absolutely massive amount of what makes the internet tick is someone’s passion project that became a lynchpin. Sometimes they get turned into or absorbed by big projects that have corporate like structures, or straight up consumed by a massive corporation, but small projects like a single compression library that almost never needs to change? It’s likely to stay the original author’s “pet” and that’s a huge continuity problem and social engineering target.