might make sense to call this package manager attack. there are real supply chain attacks that are related to distribution of physical goods