I think they're conflating two types of attacks here. One is throwing shit at the wall and hoping it sticks (uploading malicious packages to registries) And t

I think they're conflating two types of attacks here. One is throwing shit at the wall and hoping it sticks (uploading malicious packages to registries) And the other is a coordinated and long term attack where someone builds trust in an existing tool or package then inserts a backdoor with that trust.