Ars Technica Sep 9 Software packages with more than 2 billion weekly downloads hit in supply-chain attack