194
Over 100,000 Infected Repos Found on GitHub
(apiiro.com)
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Community icon from opensource.org, but we are not affiliated with them.
If you installed the original legit package it can't be updated with such fake one (without uninstalling and installing the bad one) as the signatures won't match. If you initially install the bad package then yes of course.