The state of open source software security: Changes in attack methods, policy and more

This piece discusses the rising threat of malicious packages in open source ecosystems like PyPI and npm—often via typosquatting and obfuscation—and the policy responses from U.S. (ONCD/CISA RFI) and EU (CRA). In an interview, Eclipse Foundation’s Mikaël Barbero highlights a shift where attackers seed repositories rather than chase zero-days, urges that regulation should not burden OSS maintainers, and underscores the criticality of balanced policy to protect the software supply chain without stifling open source.