Brian Campbell
(replying to Saagar Jha)
@saagar I expect this is a "it's Friday evening, we want to preserve evidence and prevent any further issues from coming up over the weekend, let's take everything down and sort it out on Monday" kind of situation.
The actual git repo is still available at https://git.tukaani.org/ (which includes the payload in the test binary artifacts), and the backdoored tarballs which activate it can be found on the Internet Archive: https://web.archive.org/web/20240329182710/https://github.com/tukaani-project/xz/releases