Supply chain attack waiting to happen
Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.
Alpine/debian packages show you the code that compiles the package from source, do you have that as well?