Modern software is built on open source: an estimated 96% of products ship open source components. This ubiquity has turned the open source supply chain into a prime target for attackers, who increasingly compromise “leaf packages” - under-maintained, indirect dependencies buried deep in dependency trees, often looked after by lone volunteers without institutional backing. Incidents like the xz-utils backdoor have shown how fragile this foundation can be, and how high the stakes are for public administrations and critical infrastructure alike.