Minor code changes may go undetected for a long time. Development teams trust the owner of the code if the modified product is properly signed. As a result, malware-laced packages can be created and assigned to trusted, popular maintainers without their knowledge. A case of misplaced trust could mean a problematic vulnerability or outright malicious code hidden in your code.It is also common for developers to copy and paste code from existing libraries or StackOverflow to use in their own code or to upload to new libraries. This increases the chances of also copying insecure and vulnerable code that is now essentially untrackable.