A backdoor in xz

I guess the attacker had the choice of putting the code into git, but chose to modify the tarball only, because he thought it would be less detected that way. A commit in git would certainly be more visible.