And with github's recent "automatically create dep update PR" feature for security notifications, it would presumably be even easier to get people to update to

And with github's recent "automatically create dep update PR" feature for security notifications, it would presumably be even easier to get people to update to a malicious version. Just claim the old version had a security vulnerability!