Again some esoteric package that likely nobody uses. If you’re worried about such attacks, private registry mirrors can go a long way.