Package Analysis Project: Scalable detection of malicious open source packages

security.googleblog.com