The unsafe assumption is that checking one package ecosystem is enough. Here, the same malicious payload moved across npm, PyPI, and an official GitHub release, so dependency reviews that stop at one repository miss the compromise path entirely. The blast radius also widened from developers to Linux users who installed a desktop AppImage from the project’s own release page.
Datadog tied the May 11 campaign to 170 poisoned npm and PyPI packages, including @tanstack/react-router and mistralai==2.4.6. The payload embedded in the malicious wheel was byte-for-byte identical to the file found in Cemu-2.6-x86_64.AppImage on the official cemu-project/Cemu release page, and Datadog says that release reached nearly 20,000 Linux users.
The forward risk is broader than a bad package upload. Teams that only audit npm/PyPI dependency graphs can still miss a compromised binary release, and the same publishing tokens or release channels can carry stolen credentials and token access into unrelated products.