xz backdoor: 5 Lessons

CVE-2024–3094 — also known as xz-backdoor or xz-trojan —  is the most concerning software supply chain attack to date.