Comment by sva_

I prefer to get my supply-chain attacks through conventional package managers