“We could take our top 5 components that we use across our organization and we could do our own threat model of them.”

Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.