+1 for Renovate - it has support for more languages/ecosystems, it is more configurable and it is fully open source. Anyway, this kind of attack would also wor

+1 for Renovate - it has support for more languages/ecosystems, it is more configurable and it is fully open source. Anyway, this kind of attack would also work with Renovate but you could create a good company-wide config to prevent this.