Comment by jabradoodle

It's not just a specific actor targeting a specific entity though; it's any malicious dependency being ran in a privileged environment.