It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below). The only company that has a real chance at making a dent in the issue

It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below). The only company that has a real chance at making a dent in the issue is GitHub and to a degree they already have. SOURCES: - https://www.mandiant.com/resources/blog/supply-chain-node-js https://www.mandiant.com/resources/blog/supply-chain-node-js - https://www.zdnet.com/article/backdoor-found-in-ruby-library-for-checking-for-strong-passwords/ https://www.zdnet.com/article/backdoor-found-in-ruby-library... - https://www.reversinglabs.com/blog/mining-for-malicious-ruby-gems https://www.reversinglabs.com/blog/mining-for-malicious-ruby... - https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-package-delivers-coin-miner-and-credential-stealing-backdoor/amp/ https://news.sophos.com/en-us/2021/10/24/node-poisoning-hija... - https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/amp/ https://www.bleepingcomputer.com/news/security/dev-corrupts-... - https://portswigger.net/daily-swig/amp/malicious-python-library-ctx-removed-from-pypi-repo https://portswigger.net/daily-swig/amp/malicious-python-libr...