[cma]

Also possible that a Lenovo employee was at a coffee shop using wifi connected to the corporate CMS using http"s" and someone unrelated to Lenovo linked their fake repo on his/her behalf.