Focused open source attacks. Smells like a corporate sponsored action.

I don't know that it's corporate sponsored so much as corporate subsidised: via LLMs that cost more to operate than people pay to use them...

Also probably a lot of well intentioned AI code introduced vulnerabilities and bugs, with each bug providing opportunities for a new supply chain attack in the form of a fix...

The only sponsorship is from corps constantly paying data ransoms