[tedunangst]

It's not immediately clear, however, how one would conduct a cache timing attack against the package manager.

[Sephr]

Through bad antivirus code that inadvertently runs your code in a sandbox. There have been multiple vulnerabilities like this recently.

[tedunangst]

Sounds like we should design our package managers so that they don't run hostile code in a sandbox.