Conversation
I've been looking around for projects with similar potential as xz. Unsurprisingly lots of GNU projects, they do the groundwork, are direct or indirect dependencies everywhere, were feature complete years ago, no new development, one last guardian of the code with credentials to ftp.gnu.org.

There's one hurdle that could raise the difficulty of infiltration though, the FSF copyright assignment paperwork.
0
1
2