Malicious xz backdoor reveals fragility of open source