Another malware wave is washing through open-source software repos, stealing publishing tokens, installing OS‑level backdoors and persisting in developer tools and CI pipelines.

The campaign hit major registries and hid behind legitimate-looking release signatures, showing how attackers can weaponize the software update process itself.