Update as this sitation is evolving very quickly, Lasse Collin (the original XZ maintainer) is aware of the backdoor and will begin work soon to clean up the project.

Jia Tan has also committed to the kernel in the past so now they're also scrambling to analyze some code.