Not surprising, but good to keep in mind. So, one difference here is that when you try to get hostile code into a git or package repository, you can often figu

Not surprising, but good to keep in mind. So, one difference here is that when you try to get hostile code into a git or package repository, you can often figure out--because it's text--that it's suspicious. Not so clear that this kind of thing is easily detectable.