Echoing similar comments on this thread. The action in itself is mildly concerning, but the lack of foresight to see this as an issue people would want to know about, and ultimately be able to make their own decision on if they want to accept that risk or not.

"So I thought that maybe user don't want to care about this intermediate process"

Choosing to include an unverified build from a third party in a project like this introduces significant risk.

Also.. anyone know why my original comment got flagged?