SUPPLY-CHAIN REPORT

tukaani-project/xz

XZ Utils

VERDICTCOMPROMISED·54/100

View on GitHub →

STARS

1,501

FORKS

224

OPEN ISSUES

LANGUAGE

LICENSE

NOASSERTION

LAST PUSH

2026-03-31

SIGNALS

BAD

Historical supply-chain incidents

1 known incident on record. Worst: CVE-2024-3094 — xz-utils backdoor (jiatan).

INFO

Historical security advisories

3 disclosed advisories (0 critical, 1 high) — typically patched in newer releases. Pin to the latest version.

Maintenance activity

Actively maintained. Last push 17 days ago.

Ecosystem trust

1,501 stars.

WARN

License

No clear license. Using an unlicensed repo in production carries legal risk.

HISTORICAL INCIDENTS (1)

CRITICAL2024-03-29

CVE-2024-3094 — xz-utils backdoor (jiatan)

Malicious code injected by long-term maintainer "Jia Tan" into xz-utils 5.6.0 and 5.6.1 releases, creating an SSH backdoor in Debian/Fedora builds. Caught by a Postgres dev investigating a 500ms login delay.

Source →

METHODOLOGY

This report is generated on demand by querying the GitHub API for repository metadata and published security advisories, then cross-referencing our curated database of known supply-chain incidents (xz-utils, event-stream, ua-parser-js, colors.js, tj-actions, Codecov, and more). Results are cached for 24 hours. We do not scan repository code or dependencies — for that, see Snyk or Socket. Verdict: CLEAN ≥80, CAUTION 50–79, COMPROMISED<50.

SCAN A DEPLOYED SITE

Repo looks clean but the live deployment might still be exposing headers, CORS, or SSL misconfigurations.

SCAN A URL →

SCANNING tukaani-project/xz...