[Tenobrus]

It looks like the person who added the backdoor is in fact the current co-maintainer of the project (and the more active of the two): https://tukaani.org/about.html

[kzrdude]

In various places they say Lasse Collin is not online right now, but he did make commits a week ago https://git.tukaani.org/?p=xz.git;a=summary

[kzrdude]

Makes me wonder if he's an owner of the github organization, and what happens with it now?