Security researcher Costin Raiu tells Wired the XZ Utils attack is far more “cunning” than anything he’d seen previously. Others have looked into when Tan submitted their code.