It Wasn't Your Code - Understanding Supply Chain Failures

I ran composer update on a side project a few weeks back and watched a few dozen packages move. I manually reviewed maybe three of them. The rest I waved through, because that is what we all do. The lock file said the hashes matched what Packagist served, the tests passed, and I had other work to ship.