xz-utils was kind of a perfect candidate for a backdoor: it was a depedency of critical software (openssh) but at the same time no one really knew about it so it was not that well reviewed.

Where is the next backdoor going to be? My money is on some nginx hidden dep. #infosec