Why SCA sucks (at detecting malicious packages)