TeamPCP, the hackers behind the Shai-Hulud worm, has done significant damage to the open source ecosystem. But it's not necessarily due to skill alone.
The Hackers Behind
Exploit
Dark Reading
Apply vendor security patch