did RPM packages get compromised?