What Log4Shell taught us about open-source supply-chain security

On 9 December 2021, a security researcher publicly disclosed a critical remote code execution...