I'm sure the prism/NSA angle is still in play, how easy is it to compromise millions of projects in production owning both github and npm?