If I were a state actor trying to introduce vulnerabilities in an adversary's system, handing the guy who runs sqlalchemy (or whatever, pytorch, logger take you

If I were a state actor trying to introduce vulnerabilities in an adversary's system, handing the guy who runs sqlalchemy (or whatever, pytorch, logger take your pick) $250,000 to modify their package with my vulnerability would probably be step 0 or step 1