They call it "supply chain" attack, I call it "nobody in this fucking industry has any decency left anymore" attack

(Also no, open source is not a supply chain https://www.softwaremaxims.com/blog/not-a-supplier)