Comment by Anon1096

There was just 2 active maintainers on xz, and the compromised individual has been the primary for >1 year. If anyone were to fund development time on it, ironically it would go exactly to the person working to backdoor it.