That's a different thing; it would (ab)use some package tools' preference of public packages over private ones (at least in some configurations). It's not reall

That's a different thing; it would (ab)use some package tools' preference of public packages over private ones (at least in some configurations). It's not really a "supply chain issue" but more of a "footgun in some package tools"-issue.