Arch wasn't affected at all, cause the backdoor trigger was only on deb and rpm distros.

However it still a good practice to update your system and leave this version behind. Anyway, Arch already updated and is no longer distributing the backdoor version, therefore 5.6.1-3 is safe

You can use Arch btw again. Actually, you never had to leave it at first

You switched distros because of this? 😆

TL;DR: starting with 5.6.1-2, XZ is safe on Arch. Safe as in not affected by this particular vulnerability.

Look here: https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad

And here: https://security.archlinux.org/ASA-202403-1

5.6.1-2 is where the package switched from building from the tarball (backdoored) to the upstream git repo (clean). The tarball release contained some extra build instructions (which didn't exist in the git repo) that added the backdoor during the build process. The issue arose from the downstream maintainers' assumption that the contents of the tarball and the git repo were identical.

Subsequent changes, and 5.6.1-3, were mostly administrative, like changing the git repository's URL (since the maintainer's github account was banned) and locking out Jia Tan's PGP key.

an article which said that in 5.6.1-3 the backdoor was “fixed” by just not letting the malware part communicating with the vulnerable ssh related stuff

That article is bullshit, don't believe a thing it says. Arch was not affected by the SSH vulnerability because the sshd binary did not link liblzma where the backdoor existed, so they could never communicate in a way that could be exploited by this particular vulnerability. It was not part of the fix.

The back door was crafted to be used by a very specific encryption key. You are are vulnerable if the attackers are specifically targeting you. If you are a tangent of a nation, you should be worried:)

When i first heard of xz backdoor, i updated my arch system and the xz-utils package to 5.6.1-3 which in the version numbers seems to be a patch, and it seems to be, so think you're safe from now

It's over. Nothing to see here. Move along.

Do you host anything on your network to tne internet that allows anyone ssh access to your computers? More simply do you have port 22 open on your router or firewall? If you don't or said no, then don't worry about it.