Supply chain and operational attacks keep landing
Zod 4.6.6 was flagged as compromised. A commit titled "Fix bugs and improve performance" added a malicious remote-code loader that injects a JS payload at install time by fetching it from a remote host. The thread title was changed from "might be" to confirmed during the discussion.
In a different corner, hackers triggered automatic defrosting on supermarket fridges across Europe, which commenters pointed out will mean wasted food. One recalled a similar incident at US military exchanges a month or two earlier.
The pattern: attackers are going after the boring, trusted layer, a dependency everyone installs without reading or a networked appliance nobody thinks of as software. The harm is quiet and physical or silent-until-it's-everywhere.
So what?
Pin versions, delay upgrades by a few days, and review install scripts for anything in your critical path. If you make connected devices, assume remote control is a target and build update and kill-switch paths accordingly. Customers will start asking about this in security reviews.