OSS in the crosshairs: Cryptomining hacks highlight key new threat

**Executive Summary:** Multiple popular open-source packages (notably rspack and vant) were compromised to deliver the XMRig cryptominer via malicious updates; attackers leveraged stolen publishing credentials and GitHub Actions/script injection, added obfuscated files and external C2 communications, and forced maintainers to remove affected versions and publish clean releases, underscoring the growing trend of supply-chain attacks and the value of differential analysis for detection.