Lightning strikes the supply chain

Developers using PyTorch Lightning recently discovered that their favourite Python package was masquerading as a data thief to harvest credentials. This latest supply chain mishap proves that even the tools we trust to build things are perfectly capable of tearing our security apart. We are left to manually audit every dependency as if we don't have enough to do with the actual work. Shielding the infrastructure from this nonsense requires a level of vigilance that most of us abandoned somewhere around the third coffee of the morning.