I'm surprised this hasn't become a malware distribution channel yet.
All of the same supply chain issues you have with packages in a programming ecosystem exist in VS's mod system.
I'm surprised this hasn't become a malware distribution channel yet.