Proprietary software is very likely to rely on the same open source dependencies, also using NPM, pypi, etc, with the same baked assumptions that allow for that

Proprietary software is very likely to rely on the same open source dependencies, also using NPM, pypi, etc, with the same baked assumptions that allow for that type of supply chain attack. Just saying that it’s a systematic problem in the way we use, manage, and consider 3rd party dependencies. And the risk already exist right now, without administration promoting open source software. (I don’t know how to protect against it at scale)