Comment by aftbit

Why do none of these hijacks embed runtime attacks? It seems like worming the build machines is the goal, rather than compromising downstream users.

It seems like we should be building and testing everything in bubblewrap or some other sandbox going forward.