The XZ Exploit was an incredible near miss. Dr Richard G Clegg of Queen Mary University London explains how a seemingly helpful contributor hid some code in part of a ubiquitous piece of software.