There was log4j the last few weeks, the malicious packages in PyPI and the ua-parser-js that was taken over. At least that's what I remember from this year.

Somewhat of an outsider here.

What’re you referring to?