Comment by jaitsu

https://go.dev/blog/supply-chain is a very good write-up on this topic too.