it's asking for me to unlock a keychain, i assumed it wants to access a private repository maybe.

i know there was similar exploits done to tiny, far flung dependencies in NPM in the past maybe a similar attack.