The xz package has been backdoored

Arch Linux