Supply Chain Attacks on Linux Distributions

It is funny that they have nothing to say about npm and cargo (and go's online repository)