Malicious Lightning 2.6.2/2.6.3 released April 30 enable credential theft via hidden payload, leading to PyPI quarantine and ...
Sleeper packages in Ruby and Go steal credentials and alter CI workflows, leading to persistent access and data exfiltration.