The XZ Utils backdoor, originally discovered in 2024, continues to pose a risk as several Docker images built from compromised Debian packages still contain the malicious code. Despite efforts to notify Debian maintainers for removal, these infected images remain publicly available, highlighting the persistent threat of backdoored software in the container ecosystem. Binarly's research emphasizes the need for continuous monitoring and detection of such vulnerabilities to protect the software supply chain.

The XZ-Utils backdoor, discovered in March 2024, remains present in at least 35 Linux images on Docker Hub, posing risks to users and organizations. Despite being reported, Debian has chosen not to remove the compromised images, citing low risk, which has raised concerns among researchers about the potential for accidental use in automated builds. Users are advised to ensure they are using updated versions of the affected library to mitigate risks.