xz-utils has a ton of build dependencies. The backdoor implant exploited a flaw in an m4 macro build dep.