I suppose, but the actual process of hosting or sharing it seems a little convoluted. And, again, they could do all this without the source code, if their goal was simply to subtly backdoor it.