Malicious code planted in xz Utils has been circulating for more than a month.