I feel this is way too fear mongering heavy against developing in Open Source. I published nearly everything I code on my free time, that's ~100 git repositori

I feel this is way too fear mongering heavy against developing in Open Source. I published nearly everything I code on my free time, that's ~100 git repositories. Out of these, ~15 are documented and made generic enough to be used by other people, and out of these ~5 actually have some users, 2 being packaged in mainstream Linux distributions and one even has a CVE. In total, I have received one AI slop PR. one. Your mileage may vary, and you may be blessed/cursed with the new redis or xz. But in all likelihood, things will stay more than manageable in terms of critical infrastructure piece.