The target was Ruby developers who use Windows and Bitcoin. I didn't get the sense that common libraries are infected - more that there are hundreds of libraries that are typosquatting. It would be interesting to find out if any of these libs ended up as dependencies.

Love the TacoBell.check_win.

The most successful attack was a change of an underbar (atlas_client) to a dash (atlas-client). Seems good to standardize these kind of non-alphanumeric characters in library names. Still, seems like open source web stores like this might need some level of human moderation?