A package I maintain once ended up in exactly this state because of a sync script.