Full threadotterley·This is a much better writeup than semgrep’s: https://www.stepsecurity.io/blog/supply-chain-security-alert...View on HN