Comment by Onavo

The most direct exploit requires a compromised supply chain which ranks it about as dangerous as your usual dependency exploits.