The threat is potentially grave because it could be used in supply-chain attacks.