I wonder if this always used to be the case, or is all this harassment the product of the past ~decade or so high exposure of open source software? As in no more sketchy websites or weird build pipelines to access them, they're basically slapped on github with an executable for anyone to use.