Comment by AQXt

...which happens all the time in the free software world, when you type `apt-get|yum|brew update`.

What are the odds of one dependency being taken over by a shady anonymous entity?