open source packages got compromised.
engineers are getting questions on social media.
volunteer maintainers found out from hacker news.
enterprise customers are furious they weren’t notified first.
This week’s focus: community expectations, rapid disclosure, & coordinating external maintainers.
