Developer Tools as Supply‑Chain Targets

Attacks are increasingly aimed not just at packages but at command‑line clients and scanner integrations used by developers and CI systems, turning widely used tooling into a pathway for downstream compromise. Detection is often by third parties (here JFrog) and can limit exposure, but even low‑volume compromises (334 downloads) undermine trust in open repositories and CI pipelines. — If attacker focus shifts to developer tooling, then software integrity, disclosure rules, and repository governance become central public‑policy and national‑security issues.