Comment by aa_is_op

By the number of malicious packages that site has hosted over the past few months, this was only a matter of time.

I've lost track of the number of "white hats" that contact us with extortion requests after they used some dependency confusion attack.