I was supporting a WordPress site and we’ve had issues getting blacklisted by Internet providers because some WP scripts were in the malware database (local file matching WP github exactly). What a nightmare.