Luckily, this backdoor (CVE-2024-3094) was caught quite early before the backdoored version was rolled out in many distributions. Andres Freund saved the internet with his attention to detail.
In the wake of this discovery, potentially other libraries that already are compromised could be discovered.
Kaspersky provides quite a detailed technical analysis. The code in amlweems/xzbot provides some great details and demo on how the backdoor would work. Gynvael has an extensive analysis of the bash obfuscation. Additional references are listed in this Gist.
In the subsequent days additional details were unearthed by binarly. Also, a very basic client implementation is available in blasty/JiaTansSSHAgent. A later post covers an Elastic and Ludus lab that fires xzbot at a backdoored Debian 12 VM.