> Said process could silently insert code into repos, corrupt the build environment, replace packages in production, or whatever. So just like pretty much any

> Said process could silently insert code into repos, corrupt the build environment, replace packages in production, or whatever. So just like pretty much any package from public repo out there ?