Mass malicious packages hit OSS registries

Researchers flagged more than 1,700 malicious packages across npm, PyPI, Go, Rust and PHP registries that posed as dev tools but delivered info‑stealers and remote access trojans. The wave of supply‑chain threats underscores that dependency hygiene and registry vetting are now operational risks for every dev team. For builders of developer tooling, supply‑chain integrity and secure defaults will be part of the trust contract your users expect. (x.com)