AI deepfakes target open‑source maintainers

Attackers are now using AI‑generated voice and face deepfakes inside convincing virtual meetings and branded Slack workspaces to trick prominent open‑source maintainers into installing trojans, then publishing malicious releases to widely used packages. The axios compromise (millions of weekly downloads, malicious versions removed after ~3 hours) shows the technique can scale across the Node.js/npm ecosystem and affect cloud deployments. — If deepfake‑enabled social engineering becomes routine, it converts individual maintainer trust into a systemic national‑security and infrastructure risk that governments, platforms, and enterprises must address.