Package‑manager tampering enables mega‑heists

Attackers can seed a malicious version of a popular developer package (Homebrew in this case) that delivers an AI coding tool, exposing developer machines and internal AI tooling and enabling long‑running intrusions. Combined with social engineering (fake job interviews) this turns routine developer workflows into high‑value attack vectors against custodial crypto infrastructure. — This shows developer supply chains and internal AI services are systemic cyber risk hotspots that demand industry standards, corporate controls, and possibly regulation to protect financial and critical infrastructure.