> I feel that the differentiation between "lifting keys" and "maliciously using them" is not a useful one to make. You misunderstood: the differentiation was b

> I feel that the differentiation between "lifting keys" and "maliciously using them" is not a useful one to make. You misunderstood: the differentiation was between malicious packages being uploaded and actually being used, not between the keys being stolen and being used. I agree that the latter would not be a useful or productive distinction to make. To be clear: supply chain security is serious, and there are sophisticated (organized crime, nation state) actors in the space. But that isn’t what this is; the lack of sophistication makes that clear. It’s true that indices could probably be doing more to stop this kind of stuff, and many are; see the adjacent comment by ‘SethMLarson.