Darren writes.

But for the past 10-20 years there is a separate trend in industry where you just code “glue” between components in some package repo like npm for JavaScript; pip for Python, etc.

And the rubber necks all came out to know-it-all.

Andres Freund writes.

The upstream xz repository and the xz tarballs have been backdoored.

The hits keep coming.