amlweems/xzbot

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

3554 stars · 235 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A research toolkit for the xz backdoor (CVE-2024-3094) containing an OpenSSH honeypot patch to detect exploit attempts, a patch script to replace the backdoor's ED448 public key, and a CLI demo that triggers the RCE. It documents the backdoor's payload format for security research.

Use cases

• detect xz backdoor exploit attempts against ssh servers
• demonstrate the CVE-2024-3094 RCE exploit
• analyze the xz backdoor payload format
• patch liblzma to test the backdoor with a custom ED448 key
• set up a honeypot for supply-chain attack research

When to choose

• researching or teaching about the xz supply-chain backdoor
• checking whether attackers are attempting to exploit CVE-2024-3094
• reproducing the backdoor in a controlled lab environment

When to avoid

• hardening production SSH servers against the backdoor (patch xz instead)
• general-purpose honeypot infrastructure beyond this specific CVE
• projects requiring a maintained, licensed dependency

Facets

cli-tool · maturity maintenance

security penetration-testing reverse-engineering cli security developer-tools operating-systems go python cve-2024-3094 xz-backdoor supply-chain-attack honeypot exploit-demo openssh linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="amlweems/xzbot")