Official, popular, longstanding (20 years!) Linux distro is clearly distributing "a virus" via an official repo, with nothing about the danger on its website?

Official, popular, longstanding (20 years!) Linux distro is clearly distributing "a virus" via an official repo, with nothing about the danger on its website? Linux mantra: Nothing wrong here, and if there is, someone will fix it eventually, probably, maybe..