“No supply chain attacks”

Wasn’t https://anchor.host/someone-bought-30-wordpress-plugins-and-... like, a month ago?