> And still completely missed the xzutils compromise. There's no comparison. That was the culmination of a three-year effort -- almost certainly state-backed.

> And still completely missed the xzutils compromise. There's no comparison. That was the culmination of a three-year effort -- almost certainly state-backed. Stuff like that happens maybe three times a decade, and makes headlines. Meanwhile supply chain attacks against language-specific package managers are a monthly or perhaps even weekly event. There's no comparison.