Open Source Insights
Handy site, backed by Google, that lets you dive into packages from different ecosystems and see what they depend on and what depends on them, etc.
Everything I know about the XZ backdoor
A timeline of the events in the creation of the xz backdoor.
A Microcosm of the interactions in Open Source projects
Some background on how the xz backdoor situation arose.