4 ms·

Thanks, that makes much more sense. I only looked at the domain name matching the package name. I'd still like to remove it but it feels much less worrying.