TeamPCP, the cybercrime group behind later waves of the Shai-Hulud worm, has done significant damage to the open source ecosystem. But it's not necessarily due to skill alone.
Shai-Hulud Hackers TeamPCP:
Exploit
Dark Reading
Apply vendor security patch