Reminded me of a similar story at openSSH, wonderfully documented in a "Veritasium" episode, which was just fascinating to watch/listen.
https://www.youtube.com/watch?v=aoag03mSuXQ
The xz compromise was not "at openSSH", and worked very differently.
The xz compromise was not "at openSSH", and worked very differently.