It honestly surprises me we don't hear news about vim/neovim plugin supply chain attacks.