This is not a supply chain attack, it is sudden extreme enshitification. according to the article, the attacker also bought the GitHub repo

I don’t see how buying the GitHub repo as well makes it not a supply chain attack but enshitification.

They bought into the supply chain. It’s a supply chain attack.