How about all the throubles with hijacked NPM packages? These attacks are still "small", but have had big effects, multiple times.