Supply Chain Attacks: Owning the Install Step

Dependency confusion, typosquatting on npm and PyPI, install-script code execution, maintainer account takeover, and the Shai-Hulud self-replicating npm worm