In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation