Oh, I see. I understand how this would apply. Now I'm curious if it has been successfully used in any case of malicious open-source software.