A Supply Chain Attack, a Worm, a Dead Drop Hidden in GitHub Commits, and a Filesystem Wiper.

A supply chain attack, a credential-harvesting worm, a geopolitical wiper, and thirteen lines of Python that started it all.