tbf this is happening with a lot of package managers now, including pypi and composer