[pixl97]

How exactly does that work?

I don't think that HNers understand the recent supply chain attacks very well at all. I also don't think they realize the tests the SCA/package providers do to all the major packages.

Almost all these attacks try to reach out to external sites to steal your data. That is exceptionally hard to hide in any meaningful way.

[yearolinuxdsktp]

That’s a bold claim to make about HNers. Au contraire, security companies have absolutely missed supply chain attacks.

Example:

https://snyk.io/blog/node-gyp-supply-chain-compromise-self-p...

Before that we had event-stream, then we had XZ compromise.

It’s not exceptionally hard to delay reaching out to external sites until after a cooldown period.

[drdexebtjl]

    def steal_your_data():
      if datetime.now() < three_days_after_attack:
        return
      reach_out_to_external_sites()

[mplewis]

OK, so it looks like you've still added suspicious code to your package.

[drdexebtjl]

You can make it much less suspicious. In particular, if you can compromise the package publishing process, and not just pushes to main, you can add your malicious code to binary artifacts, not to the source code.