A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless ...