Embed Notice

Re #XZ attacker - the known threat actor account made various changes across multiple open source projects and documentation.

Library maintainers should not look at those changes in isolation of just that line change, or assume the threat actor only became malicious later. Assume they have very well resourced and acting with broad objectives.

In at least one case they made an existing unknown vulnerability exploitable, and we know they were socially engineering the XZ maintainer years ago.