Impossible to code inspect and verify. Someone else commented 'smells like a supply chain attack' and while I'm sure it's not intended to be, there is no way to verify. And who believes, in half a million lines of code, no bugs have been introduced?