i suspect awareness on supply-chain attacks is already low (though it seems to be increasing in recent times). the attack surface is everything an agent can get their hands on.

Just look at the closed PRs of their project. General technical knowledge is so low it's insane. It attracts weird people.