I wonder if there is anything else cmake related that should be looked at.
Wasn't cmake support originally added to xz to use with Windows and MSVC?
Wasn't cmake support originally added to xz to use with Windows and MSVC?
At this time we don't know exactly how much is affected and what originally drew the attention of the attacker(s).