The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries

It looks like this is being exploited in the wild [0].

[0] https://twitter.com/mszustak/status/963322531729018880