Open-source software may contain intentionally hidden threats which can leave the products that use malicious packages vulnerable to manipulation, including supply chain attacks.
Malicious packages are threatening software supply chains
Open Sores: Kaspersky reports a 48% increase in malicious packages threatening software supply chains.