The fact that it took this long to surface raises important questions about OSS security in the age of instant updates. This was a paid product, not even some s

The fact that it took this long to surface raises important questions about OSS security in the age of instant updates. This was a paid product, not even some sub 100 star github project made by groyper6969. Everytime we do pip install or an npm install the chance of this happening is atleast 100 times greater. (Judging by the amount of subdependencies every package seems to have nowadays)