I see you this, and I raise you "the package repository I was mirroring contained an AV module that had a copy of EICAR in its test suite".

AAAAAAAAAAAAAAAAAAAAAAAAAAAARGH.