> With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. A

> With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. As far as I know common targets for malicious packages are crypto (mining, wallet swiping), and credentials (SSH, package repositories), none of which is limited to businesses. There's been some cases of politically motivated sabotage lately but mostly from the maintainer themselves so far - expect more of that though. Often a compromised package will try to steal more credentials from downstream users. [1] I don't doubt that threat actors all the way from script kiddies to nation states are keeping a stash of credentials to package repositories, and it's going to suck for everyone when they decide to use them. [1] https://www.bleepingcomputer.com/news/security/compromised-javascript-package-caught-stealing-npm-credentials/ https://www.bleepingcomputer.com/news/security/compromised-j...