A truly patient malware author wouldn't even necessarily need to make it obvious. You could upvote something over the course of six months and still have a very

A truly patient malware author wouldn't even necessarily need to make it obvious. You could upvote something over the course of six months and still have a very negative impact. Hell, you could create a library, not have malware in it, answer the questions, wait six months, add the malware. Oh wait, I'm not a criminal. Forget I said that. Patience is unlikely for individuals, but it becomes a real concern when you come to the point of state-based actors. I regularly use Python libraries in my work that emulate Excel. and they're so often out of date, they're so abandoned/unloved for the most part because the people that write them eventually move on and they don't have a big enough user base. That means that they're ripe for somebody inserting stuff. Worse Excel is usually used by big companies, so it's a target as well.