Story Set Up:

One day you get a strange envelope in the mail. No obvious significance of the return address, it's just a shipping depot. In the large bubble envelope you find... your childhood journal. An old tattered notebook full of drawings and writings you remember well. Who could have sent it? A relative?

But there is another much more serious issue. One you are reluctant to even confront.

You never lost your old childhood journal. It's right there on the shelf.

There are *two* copies.

I don't think people are quite grasping the issue with software supply chain attacks. It's not just a case of compromised built software, it's also the build time. One popular package being compromised means every other package that depends on it is also now potential compromised or soon to be. And the targets can often move across other repos in the same org or account

Basically a slow moving worm today is rapidly accelerating to collapse. Kessler syndrome of software packages.