Supply chain attacks are nothing new, unfortunately. Though the last few got me scared. Like this one, around LiteLLM python library. The LiteLLM one was particularly nasty one, as it was enough to just install the library.
I love open-source community and what it provides to all of us. But social engineering makes it too hard to keep your keys private.
The good news is, private ssh keys are more or less safe when used via ssh-agent, and keylogger is hard to setup without privilege escalation (at least on linux). So please, please, please do not blindly type your password in a random pop-up window.
References: