My takeaway from the #xz backdoor is that I will now treat any and all “is this still being maintained”-esque messages in open source repositories with the hostility merited a nation-state supply-chain attack on open source as a concept.