How secure is your build/server? a story of packages and trust