Supply-chain attack hits dozens of popular open-source packages

Incident summary

Security researchers identified typosquatted packages with obfuscated install scripts targeting developer machines.

Mitigation steps

• Pin dependency versions
• Enable lockfile verification in CI
• Rotate secrets if installs occurred after the compromise window