> Still 500 K out of 7M that'd be using a malicious package would still be staggeringly high. I don’t doubt it. How often do you think people really audit thei

> Still 500 K out of 7M that'd be using a malicious package would still be staggeringly high. I don’t doubt it. How often do you think people really audit their dependencies? And with the sophistication demonstrated in that xz attack, it’d probably be hard for the average dev to tell if a package is malicious even if they did.