Comment by woodruffw

> From some of them perhaps, but plenty hide for -years- undetected.

Which ones? Not even xz-utils was years (it was weeks), and it’s the poster child for a attacker doing everything right until the very end.