It uses sha-1 for each piece of content. Although sha-1 considered insecure, I'm not sure of practical possibility to introduce collisions while injecting worki

It uses sha-1 for each piece of content. Although sha-1 considered insecure, I'm not sure of practical possibility to introduce collisions while injecting working malware. Should be very hard.