in my opinion a supply chain attack on open ssh over xz.

https://nvd.nist.gov/vuln/detail/CVE-2024-3094

This time it was discovered (by accident), but how often has it worked or will it work?