Ah - is the problem a malicious administrator of the repo you're pulling from?