Confirm the exact package with the requester before downloading. The file is parsed, never installed or run.