A hidden backdoor was planted over years by a trusted maintainer ('Jia Tan') in the xz-utils compression library, targeting OpenSSH sshd via liblzma to allow remote code execution.
Nearly shipped in mainstream Linux distributions; caught days before wide release. One of the most sophisticated OSS supply-chain attacks ever found.
Hidden code was planted to grant the attacker covert access or remote code execution.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.