# amlweems/xzbot

notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

Repository: https://github.com/amlweems/xzbot
Canonical: https://ross.abutalabs.com/products/xzbot
Language: Go
License Family: other
Last push: 2024-04-03T04:58:50+00:00

## Health v2 (maintenance only)
Score: 25/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 63
- inputs: {"age_days": 884, "days_push": 882, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3554, forks 235 (observed 2026-08-28T04:08:09.639994+00:00)

## What it is
A research toolkit for the xz backdoor (CVE-2024-3094) containing an OpenSSH honeypot patch to detect exploit attempts, a patch script to replace the backdoor's ED448 public key, and a CLI demo that triggers the RCE. It documents the backdoor's payload format for security research.

## Use cases
- detect xz backdoor exploit attempts against ssh servers
- demonstrate the CVE-2024-3094 RCE exploit
- analyze the xz backdoor payload format
- patch liblzma to test the backdoor with a custom ED448 key
- set up a honeypot for supply-chain attack research

## When to choose
- researching or teaching about the xz supply-chain backdoor
- checking whether attackers are attempting to exploit CVE-2024-3094
- reproducing the backdoor in a controlled lab environment

## When to avoid
- hardening production SSH servers against the backdoor (patch xz instead)
- general-purpose honeypot infrastructure beyond this specific CVE
- projects requiring a maintained, licensed dependency

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, reverse-engineering, cli
- domain: security, developer-tools, operating-systems
- platform: go, python
- tags: cve-2024-3094, xz-backdoor, supply-chain-attack, honeypot, exploit-demo, openssh, linux

## Member repositories
- amlweems/xzbot (main) score 25

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:09.639994+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:34:17.589992+00:00, confidence not recorded.
  - readme: https://github.com/amlweems/xzbot (fetched 2026-08-28T04:08:09.639994+00:00, sha 581583cdfa1f)
- Data as of 2026-08-30T08:39:29.467469+00:00.