malicious versions are recalled and removed when caught - so you don't need to update to the next version

An announcement isn't a quiet action. One would hope that the real maintainers would notice & take action.