I think that's a slight mischaracterization. It was present in the repo but obfuscated and rigged to only apply in release artifacts.
A sufficiently technical user could have found it but that bar was pretty high to clear.
A sufficiently technical user could have found it but that bar was pretty high to clear.
>This injects an obfuscated script to be executed at the end of configure. This script is fairly obfuscated and data from "test" .xz files in the repository.
>The files containing the bulk of the exploit are in an obfuscated form in tests/files/bad-3-corrupt_lzma2.xz tests/files/good-large_compressed.lzma committed upstream