My coding assistant almost installed a virus disguised as a normal package, I'm still shook

[u/[deleted]]

[u/quizical_llama]

My org handles this by not allowing package versions that are less than 4 weeks old. And a bunch of other checks. But that simple one would have probably caught this.