The “supplier” incurring liability should always be the person who imports an open-source dependency into a commercial project, not the upstream author, and that’s how the EU’s cyber-resilience act (CRA) and the upcoming Product Liability Directive deal with it:

https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/

Your post seems to imply that software supply chain security is an issue only for open-source software. You make a good argument for why it is an issue for open-source software, but I would argue that the same issue applies equally to non-open-source software.

In fact, several reasonably recent, large supply chain-related security incidents (Solarwinds and CrowdStrike to name two, and yes I count the CrowdStrike mess as a supply chain incident) have been in proprietary software.

And if we're willing to remove the "software" part of the term, the recent exploding pagers also count as a supply chain security issue.

Supply chain security is simply about the trust we (must) place in someone else who provides something - anything - to us.

Perhaps MFA wouldn't have stopped the XZ Utils backdoor. And perhaps the same thing can be said when the maintainer of a project gets offered a large sum of money to willingly (and secretly) hand over the keys to the kingdom, and thereby allowing malicious actors to push malicious code. (I vaguely seem to remember that something like this happened with a popular browser add-on, but cannot find it now).

But it's an imperfect world. I would rather see some of the attack vectors get blocked by something like MFA, than do nothing at all.

Fazal wrote:

The “supplier” incurring liability should always be the person who imports an open-source dependency into a commercial project

But I don't see anything in the linked post to support that. That would be a huge change, making software developers akin to engineers (which, to be fair, some of them do falsely claim to be). They'd have to carry professional insurance, have the authority to tell their employers "no", and meet standards of competent engineering—even when reviewing code by other people. The Cyber Resilience Act appears to apply to "manufacturers"—that is, companies selling products—and not individuals.

I vaguely seem to remember that something like this happened with a popular browser add-on, but cannot find it now

Is it the Stylish extension you were thinking of, maybe?

I believe it's happened to a number of popular extensions. Some of the cases are reasonably well known because the change of ownership was relatively open, but others have been more covert and only discovered well after the fact. Apparently authors of a number of popular extensions have reported getting quiet offers of this nature, too.

(My memory is that the widely publicized cases haven't been done by malware people but by surveillance advertising, which at least pretends to not be 'malware'.)

I honestly cannot recall, but I think it was a popular ad-blocker ? And yes, now I do some more searching on this subject, it indeed seems to have happened quite a few times with different extensions.

You are probably thinking of uBlock. The original author got annoyed with his customers and gave it to someone else for maintenance. Later the second party sold it to a sketchy adblock company with "acceptable ads" scheme. This is the reason why you need to specify "uBlock Origin" when recommending blocker for anyone. I don't know of any other trusted browser blockers.

https://en.wikipedia.org/wiki/UBlock_Origin

Could be. Or, now I have done more searching on this matter than would be considered healty, it seems that Nano Adblocker / Nano Defender are also likely candidates. Oh, well.