Mm-hmm.

It's named after Dune, and there's been hundreds of them.

Uh, maybe that's a bit hyperbolic, but there's been ma- uh, many of them and very different, many different variants where they would steal developer tokens and, um, and publish the secrets in public on GitHub and then steal more secrets and kind of continue this compromising more and more NPM packages.

But the first version of that actually, uh, compromised a package called Nx.

Uh, this is last year.

Sure.

That is why it is the least secure ecosystem now, and they're doing things to, um, they're do- they're, they're actually making some great decisions now.

They've just recently announced that they're no longer going to, um, allow by default, uh, post install scripts and some other things.