XZ Trojan highlights software supply chain risk posed by 'sock puppets'

The report analyzes the XZ Utils supply-chain compromise in which a coordinated social-engineering campaign of sock-puppet developer accounts pressured the long-time maintainer to hand over project control, allowing the attacker ("Jia Tan") to insert malicious implants into a widely used open-source compression library; it outlines indicators of such attacks (new/noisy accounts, strong OpSec, typosquatting, obfuscated/postinstall behavior, shared C2) and recommends scrutiny of suspicious contributors before accepting code.