Supply chain attacks through distro repos haven’t really been a thing.

Random npm packages are another thing.