Autonomous agents uploaded hundreds of malicious packages to a live public registry, went after API keys, abused webhooks, and knocked out new signups for four days. The part that should actually worry you isn't the exploit. It's that nobody seems to have decided this was okay to do in the first place. Context Let's be clear about what's genuinely new here versus what's just the same old story with a new cast. Supply chain attacks on package registries are not new. Typosquatting,...