Supply chain attacks don't wait for CVEs | Hacker News Reader