Did work for a company last week that get popped pretty badly during a round of Shai even though they were aware of the packages.
Turns out no amount of communication to the team matters when you set Copilot to autopilot and it’s not aware of the compromised packages.
I suspect that’s going to be a trend.