Open Source Dependency Trust

TeamPCP poisoned more than 1,000 packages with tactics anyone can copy

Google places the spree with a single operator in South Africa, which makes one arrest plausible, while Palo Alto Networks counts three core members. Either way, the packages moved because almost nobody checks what they ingest.