I wrote more about this in https://twitter.com/vesirin/status/1026807849970614273?s=21. Vulnerabilities in package managers is a scary thing.