Malicious code in XZ_jll.jl (v5.6.1+0) ; it could pose a problem?

[giordano]

PSA: backdoor in xz-utils and relevance for the Julia ecosystem

Statement of the problem A thread in oss-security mailing list reported that the XZ Utils project was affected by a backdoor: one of the current maintainers of the project appeared to have injected malicious code, included in versions v5.6.0 and v5.6.1 of the xz-utils package, that under certain circumstances could potentially compromise an OpenSSH client and obtain login credentials to remote systems. Affected systems and conditions for the backdoor to work XZ Utils is somewhat popular in Linu…