A successful phishing attack on a single developer let hackers inject malicious code into open-source software that is downloaded over two billion times per week. A potentially cataclysmic supply chain incident was only averted because the attackers deployed easily spotted malware.
