A great example of why I’d just about always prefer to get software packaged by my distro (Debian) over “straight from the developer” methods (including pip, npm, flatpak, etc.). I remember hearing about this and being like “Oh, that’s bad, but it’s not going to affect me.”