I prefer to get my supply-chain attacks through conventional package managers