Ledger have already proved their clownmanship, but this is preposterous. Don't they checksum the libraries? Can just anyone push bogus stuff on github or wherever it is that the code is kept? I think there's something I'm missing.

Don't they checksum the libraries? Can just anyone push bogus stuff on github or wherever it is that the code is kept? I think there's something I'm missing.