Compromising a third-party to inject code into your public & private repositories is going to be a future supply-chain compromise similar to Solarwinds