The threat group’s remarkable success targeting open-source software was inevitable and fueled by the industry’s decision to prioritize code shipping over security.

Another malware wave is washing through open-source software repos, stealing publishing tokens, installing OS‑level backdoors and persisting in developer tools and CI pipelines.

The campaign hit major registries and hid behind legitimate-looking release signatures, showing how attackers can weaponize the software update process itself.