Comment by captainlego

But, unless I somehow missed a big point, doesn't it start with the user installing a malicious package?