The project has made an official post on the subject

https://archlinux.org/news/the-xz-package-has-been-backdoore...