Really good timeline of #XZ backdoor, laying out everything known about what the threat actor was up to: https://research.swtch.com/xz-timeline