A HACKER GROUP IS POISONING OPEN SOURCE CODE AT AN UNPRECEDENTED SCALE

Summary from the TLDR newsletter

TeamPCP is deploying supply chain attacks at an unprecedented scale, turning what was an occasional nightmare into a near-weekly episode. It has corrupted hundreds of open source tools, sowing a new level of distrust in the ecosystem used to create the world's software. Even GitHub has been breached by the group through a poisoned VSCode extension. The group appears to be financially motivated as it often deploys ransomware or data extortion campaigns against its targets. It is also willing to sell victims' data to any buyer.