Don't they checksum the libraries? Can just anyone push bogus stuff on github or wherever it is that the code is kept? I think there's something I'm missing.