A couple hundred downloads? These kinds of repository are probably best used by drive-by malware. I think this (and all) repository's download log should be m

A couple hundred downloads? These kinds of repository are probably best used by drive-by malware. I think this (and all) repository's download log should be made open, or at least made viewable prior to your downloading step as part of the trust profiling.