TeamPCP, the cybercrime group behind later waves of the Shai-Hulud worm, has done significant damage to the open source ecosystem. But it's not necessarily due to skill alone.
Shai-Hulud Hackers TeamPCP: Lucky or Skilled?
Summary + source link. No paywalls, no tracking.