Report of a potential security vulnerability: by default, this package uses SHA-1 (code location) for authentication, which has been compromised (link) two months ago.