Using nixpkgs, this isn't a problem because the source hashes will mismatch if somebody tries to spoof a username with a malicious repository. We should all be

Using nixpkgs, this isn't a problem because the source hashes will mismatch if somebody tries to spoof a username with a malicious repository. We should all be using Nix more often.