If someone, for instance, takes control of their repo, then they can upload whatever they like. But that auth can be fairly securely guarded, and it's probably

If someone, for instance, takes control of their repo, then they can upload whatever they like. But that auth can be fairly securely guarded, and it's probably a very hard to do it quietly as packages are signed. But now they're hosting the ads and potentially allowing remote code execution. Now the attacker only needs to get on to a webserver to deploy a payload. That's why it opens a new vector of attack. Moreover, if they're able to own the server quietly, they can be deploying whatever they like to a ton of people over time.