A hidden backdoor was planted over years by a trusted maintainer ('Jia Tan') in the xz-utils compression library, targeting OpenSSH sshd via liblzma to allow remote code execution.
Nearly shipped in mainstream Linux distributions; caught days before wide release. One of the most sophisticated OSS supply-chain attacks ever found.
Hidden code was planted to grant the attacker covert access or remote code execution.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.