Agree. I was working on an open source package, noticed something weird, and noticed the size of the uv.lock and got a bit scared.

It's a pandemic, I will be hardening my security, and rotating my keys just in case.