jlevy/supply-chain-hardening

Supply-chain payloads run at install, import, or repo-open…