They can hide it in your storage firmware. Sprites Mods attached a jtag to a consumer hard drive, identified the CPUs, dumped the firmware, modified it, wrote it back. When it sees a certain string in any write to the disk, it enters evil mode. Then whenever it sees something that looks like a unix password file, it substitutes it for some known value. As in, hit your webserver with the magic string in the query string portion of the request, then ssh to the box and log in with a known password. Reinstalling your OS does nothing for you since it's in the drive firmware. Also was able to reprogram the firmware online, not requiring physical access to the drive. But literally anything can be compromised. You could have DIMMs that look for magic bits and when they see them they substitute code so the nation state can have code running on your computer anytime they want. Your cpu could do the same. Once it seems some long ass string of bytes that have a particular checksum, it switches to ring 0 or ring -1 or smm mode.

https://spritesmods.com/?art=hddhack&page=1

> How can I be sure my lenovo laptop is safe?

You cannot.

Honestly that would be a decent way to become internet famous for a bit lol.