There is a gaping security hole in the widespread XZ utils that could potentially be misused to inject malicious code.