[janice1999]

How did you guys detect it? Do you use it internally or do you monitor popular packages?

[varunsharma07]

We have built an AI Package Analyst https://app.stepsecurity.io/oss-security-feed and also monitor them using https://github.com/step-security/harden-runner for runtime behavior.