No one has ever said that supply chain attacks are limited to npm.