Comment by slapslash

If there can be a „digital supply chain“ attack on packages, why shouldn‘t that be the case for the sources too?