TIMELINE OF THE XZ OPEN SOURCE ATTACK

Summary from the TLDR newsletter

'Jia Tan', the attacker who implemented the first serious known supply chain attack on widely used open source software, worked as a diligent, effective contributor to the xz compression library for over two years.