Keep WordPress updated. Use reputable plugins. Download them from official sources. That’s familiar advice, and there are good reasons for it.
But what happens when the official plugin package contains malware? Or when an attacker can send commands using a remote-management key your site already trusts?
The