13 points
*
Supply chain attacks are extremely cheap/easy and very effective, so get prepared for more of them in the future.
It really bothers me, that many companies make billions utilizing open source without contributing money/employees etc. to secure/supply/maintain supply chains.
7 points
This one might not have been that cheap. The malicious code was added by a maintainer on the project for two years. That is some patience
3 points
10 points
Happy it doesn’t affect stable versions
2 points
Did they intentionally not put the package name in the headline just to draw more clicks? Ffs
1 point
