[mdp2021]

Have you cross checked the signatures?

[wjd2030]

Nope, and it was totally my fault, though at the time I tried to find a way to report the app and I didnt see it (though I could've missed it)

[mdp2021]

> totally my fault

Not totally: the big question remains of how a tampered-with package can reach a prominent repository.