I wonder why they didn't obfuscate the code a bit more, they could have even positioned it as a reference package that helps resolve typos. Would be interestin

I wonder why they didn't obfuscate the code a bit more, they could have even positioned it as a reference package that helps resolve typos. Would be interesting to know how many systems have potentially been hit by this, and if any leaked production credentials. I think it's unlikely to yield a lot of useful results due to then drag net nature of the project. A targeted attack might make more sense (e.g. On an open source library, targeting specific developers)