So I guess this is the kind of thing that RMS wanted to prevent when he talked against unofficial packages and repos in Emacs.