The Day Caddy Stood Still

A couple of weeks ago, I went to update my VPS. Usually, I do this once a week, sometimes more frequently depending on any security news I see. I should probably have the AI agents I use do this, but I do it myself for now. I find infrastructure interesting and "boring" in a good way most of the time. While updating one of my VPSes, I got a message saying I needed to pay for access to Caddy because the repository had reached its bandwidth limit. This was from a company called Cloudsmith. I wasn't the only one getting this message, either. There was already a large discussion going on over at Caddy's GitHub. This led me down a big rabbit hole that lasted quite a few hours, and I'm still thinking about it. My first thought wasn't about the bandwidth limit itself, but whether this could be a new type of attack. Caddy is open source and free, and it's used by a lot of people, organizations, and companies. We've seen several different supply chain attacks over the years. But what if…