@Gargron I think the real problem here is that it is *possible* to do this in the first place. So many package managers are absolute security nightmares on every level.