that's exactly the kind of thing that would cause another xz-like attack or all the recent credential stealing malware .. except you can skip the malware part a lot of the time.