xz‑utils backdoor exposes limits of CVE‑driven supply‑chain scanners
The xz‑utils backdoor (CVE‑2024‑3094) was a maintainer‑trust hijack, not a code flaw, and escaped detection by CVE‑driven scanners. The incident shows that supply‑chain tools need real‑time maintainer signals and lockfile review, not just static vulnerability databases.