These attacks will become more common. I'm advocating to add a dependency firewall to GitLab so that downloads of packages that show suspicious behaviour will be paused. I've added some of the vectors of this attack to the signals to watch for with https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...