NPM

GitHub supply chain attack cloned thousands of projects, spoofed genuine users

"No-one has the time or sanity to audit every thing every build process pulls in."