wordpress guy did just that, he had a store/storage/registry for wordpress plugins, and 'forked' someone elses plugin, and started to serve 'his fork' as an upd

wordpress guy did just that, he had a store/storage/registry for wordpress plugins, and 'forked' someone elses plugin, and started to serve 'his fork' as an update, under the same name and url ( https://news.ycombinator.com/item?id=41888808 https://news.ycombinator.com/item?id=41888808 ) Autoupdate is not good, especially with malicous actors between the user and the developer, which you can't really eliminate. Still it is not literally the same as a trojan.