[sn]

I wonder if there is anything else cmake related that should be looked at.

Wasn't cmake support originally added to xz to use with Windows and MSVC?

[glandium]

But that's a check for a Linux feature. So the more interesting question would be, what in the Linux world might be building xz-utils with cmake, I guess using ExternalProject_Add or something similar.

[sn]

Yes this is Linux.

At this time we don't know exactly how much is affected and what originally drew the attention of the attacker(s).