Frankly, this kind of "issue" a minor thing, that is dependent on the character encoding. Switching to another character map, like a non UTF-* character map would reveal the issue. If anything, you can more easily get the Trojan Source/Horse portion in the languages like JS/Rust/Python that use a repository to spread packages around (like it has already been done and proven).
