Comment by pknopf

Package managers that use git are less prone to this kinda of attack (goland, rust).