Yep. It bums me out as a contributor to both package indices and someone working on “supply chain” tooling; there’s serious and interesting work to be done here

Yep. It bums me out as a contributor to both package indices and someone working on “supply chain” tooling; there’s serious and interesting work to be done here, but it’s general work (universal codesigning, automatic typosquat restrictions in indexes) rather than this kind of lazy blogspam “exploit” whac-a-mole.