Yes, this is a real problem. But the text of the email makes it seem the author was a target of some troll attack. The names do not look real on gmail (Diego jewstein ???) and the text is very llm’ish.

I’m surprised gmail spam filters didn’t catch this.

I worry that someone may be trying to incorporate a sophisticated supply chain attack. Step 1. Troll maintainers, Step 2. Find someone to maintain who can accept malicious code. Step 3. Track where this goes