I'm one of the co-founders of Phylum (referenced in the Github blog post;
https://phylum.io). Happy to answer any questions about this campaign or software supply chain attacks in general. In this case, there is follow on activity we've been tracking around this actor (Jade Sleet) that we've been quietly working to report and have removed.