I thought this would be about the repository maintainers of obscure but used dependencies, who then that sell to random passerbys who then make the dependency m

I thought this would be about the repository maintainers of obscure but used dependencies, who then that sell to random passerbys who then make the dependency malicious Because I would like to read about that experience