This is a good reminder of how supply chain attacks work. Interestingly, the same attack surface exists in smart contracts — malicious dependencies, upgradeable proxy implementations pointing to attacker contracts, and governance attacks. The AUR compromise shows that even "trusted" package maintainers can be vectors.

For contract devs: always audit imported libraries and verify proxy upgrade mechanisms. Static analysis can catch some of these patterns before deployment.