On: XZ backdoor story – Initial analysis

[smallerfish]

Not if the bash part then turns around and installs a random binary, which is often the case. How do you know how thoroughly it's been audited by third parties? Does it have a security patch mechanism built into it?