More terrifying supply chain attacks against developers