[riston]

xz most likely wasn't the only library that was targeted, there could be other similar projects as well which we haven't discovered yet. From the timeline you can see the social engineering part was quite big part.

Just thinking out loud, would it possible to go over with LLM and analyse existing OSS mailing lists and issues to classify such sentiment from the users?