There was log4j the last few weeks, the malicious packages in PyPI and the ua-parser-js that was taken over. At least that's what I remember from this year.