I know we all like to hate on canonical for literally any reason, but this happens with every single software repository that is not a closed garden and some that aren’t.

And yeah, it’s sandboxed, so the damage is far, far less than it could be.