Pure speculation - but I'm wondering if one or a few of the black hat players has figured out a good way to leverage AI to phish more effectively at scale, and are taking a stab at all the venues that host code that's within a lot of dependency chains.

You might be on point:

https://www.anthropic.com/news/detecting-countering-misuse-a...