pretty horrifying. I only use it as lightweight wrapper and will most likely move away from it entirely. Not worth the risk

Even just having an import statement for it is enough to trigger the malware in 1.82.8.