> This is ultimately the fault of the person deliberately updating their package to break other people's software. Ultimately the 2017 Equifax data breach was

> This is ultimately the fault of the person deliberately updating their package to break other people's software. Ultimately the 2017 Equifax data breach was the fault of the people who hacked into Equifax's website. We need systems in place to defend against people doing malicious things, but yes ideally individual developers shouldn't be the ones tasked with reviewing all of their dependencies' code. Operating System provided packages, for example, are generally reviewed by someone other than the author, which can lead to a more secure supply chain. Rust's cargo-crev review system also seems like a possible solution the problem.