I'm gonna toss this grenade out here, just because I don't see a better place to do it lol... One of the companies I worked at had an incident a couple years b

I'm gonna toss this grenade out here, just because I don't see a better place to do it lol... One of the companies I worked at had an incident a couple years before I started, where there were multiple malicious Python libraries being used in the code. For 3 months. Luckily, the libraries didn't do anything significant except to ping an IP address in China, actually did perform their advertised functionality, didn't exfiltrate any data other than the source IP address on the ping packets, and they were easy to replace once the situation was found out. But, for months, they had servers pinging or attempting to ping somewhere in China. Oh, and those libraries made it into our internal repos we were using to pin versions with, too. Beyond being a speecy spicy meatball of a story, the moral here is that you have to constantly be on your guard and verifying every single line of code that goes into your application somehow.