[Sammi]

It only takes one obfuscated line of code buried somewhere deep where you wouldn't expect it.

[illiac786]

True. But I think they have the means to do that on a lot of (non-russia-associated) repositories. They even probably wouldn't pick this one because it's under too much scrutiny.