"Reflections on Trusting Trust" was a demonstration of this in the C ecosystem long before package managers were a thing.
"Reflections on Trusting Trust" was a demonstration of this in the C ecosystem long before package managers were a thing.