CISA chief frets about open-source vulnerabilities, delayed security improvements

CISA's acting director warns of escalating open-source supply‑chain attacks—highlighting a case where a hijacked maintainer pushed malicious axios updates and citing TeamPCP as conducting widespread open‑source attacks—and calls for stronger vulnerability management, coordinated disclosure, and remediation practices.