Commit timestamps place the xz backdoor author in a UTC+8 country

Assessment

The underlying data is real and accurately reported. In an analysis posted to the oss-security mailing list on 10 April 2024, Alejandro Colomar examined the git history of xz and found 676 of 690 commits timestamped at UTC+0800, with four at +0200 clustering in winter months and ten at +0300 falling in summer. He hypothesised a author resident in a +0800 country — China, Taiwan, Hong Kong, the Philippines or Irkutsk — possibly working for an intelligence service in a +0200/+0300 zone, and explicitly presented this as a hypothesis rather than a finding. The inference does not survive scrutiny, because the metadata is attacker-controlled. A git author can set any timezone before committing, and a multi-year operation built on a fabricated persona has obvious reason to do so. Researchers Rhea Karty and Simon Henniger subsequently argued the timestamps were likely set deliberately, noting that the author committed on notable Chinese public holidays while making no commits on Christmas or New Year — a pattern pointing away from China rather than towards it. No government or intelligence agency has publicly attributed the xz backdoor to any state or nationality. The rating is Unverified rather than False, and it is not a criticism of the original analysis, which was careful about its own limits. What is rated here is the conclusion as it travelled downstream, where the qualifier was dropped and a hypothesis about commit metadata became a statement about who the attacker was.