content: Just FYI, this is the results of just one compromised software library. I'm sure there are many others out there. There are ways to get bad software in various package management systems, or to upload a bad version of a software on Github, or other things like that. Developers download that, and unknowingly get the malware to their users.