The Six-Minute Worm: How trusted publishing turned a closed PR into a global supply chain breach

On May 14, 2026, the open-source community witnessed its most aggressive supply chain escalation to date. In a window of just six minutes…