> A bad actor could create a really good open source library or package, wait for everyone to use it and then introduce malware into it. This often happens wit

> A bad actor could create a really good open source library or package, wait for everyone to use it and then introduce malware into it. This often happens with Chrome browser extensions that change hands and the new owner then injects malware or crypto mining or keylogging etc. into the newly acquired extension.