Developer Andrej F. noticed something off: a tiny performance glitch in Linux code. That observation prevented catastrophe, exposing a sophisticated backdoor planted by suspected Russian hackers in the critical 'xz utils' package. This episode reveals how state-sponsored attackers nearly compromised global infrastructure by exploiting open-source software's greatest vulnerability: its reliance on overworked volunteers.