4 votes
Accepted

Why did the xz-tools attacker put so much effort into hiding the malware when they could manipulate the tarball?

This means the code inside the tarballs differed from the repository code, which seems to be not unusual as confirmed here: Indeed, it's common to make release archives that have additional files ...
Gilles 'SO- stop being evil''s user avatar

Only top scored, non community-wiki answers of a minimum length are eligible