Socket will block it with free malicious package firewall

"What used to be an occasional outlier is becoming disturbingly common, driven by increasingly sophisticated social engineering tactics aimed directly at maintainers. The result is that traditional defenses aren't enough to protect developers and organizations that rely on open source."

"Supply chain attacks are becoming more frequent and more damaging. Attackers are getting the keys to the kingdom more often than ever before, and developers need defenses that work in real time."

"With Socket Firewall, we're giving the community a free tool that blocks malicious dependencies at install time, across multiple ecosystems. We pioneered the 'safe npm' approach, and this is the natural next step that we believe will quickly become the standard way developers protect themselves from supply chain attacks."

Socket released a free command-line tool, Socket Firewall Free, that extends its safe npm approach beyond JavaScript/TypeScript to Python and Rust. The tool integrates with npm, yarn, pnpm, pip, uv, and cargo to block malicious dependencies at install time across multiple ecosystems. High-profile maintainer-account compromises have risen, affecting projects such as tinycolor, chalk, nx, and eslint-config-prettier, and traditional defenses are increasingly insufficient. Fifty-four percent of large organizations identified supply chain challenges as the largest cyberdefense barrier. Socket Firewall uses a different technical mechanism than safe npm to provide real-time protection for developers and organizations.

Read at Theregister