I'm surprised that things like this don't happen more often. It seems like uploading malicious binaries to npm or other registries would be fairly easy.
Then again, convincing people to play around with a model might be easier than getting them to use your library in an application.
Then again, convincing people to play around with a model might be easier than getting them to use your library in an application.