October has been an absolute nightmare for software > Railway - customer secrets exposure > LiteLLM - malicious PyPI + Docker releases > Zeabur - infrastructure breached > OpenCode - AI API keys exposed > OVHcloud CLI - official binaries backdoored > Rank Math PRO - malware in official plugin > TeamUpdraft - customer data compromised > ConnectWise - cloud backup identities compromised > Tensorlake - npm package infected > SubQuery - backdoored npm package > GhostAction - GitHub repos with malicious workflows > PHP - critical RCE vulnerabilities > Node.js - security vulnerabilities patched > eMudhra - certificate authority keys compromised > Tailscale - eMudhra incident At this point, the biggest security risk might not be the code we write, but the code we trust...