Block a phishing or hijack attempt

package_control/package_manager.py

@@ -418,6 +418,9 @@ def list_repositories(self):
         updated_channels = []
         found_default = False
         for channel in channels:
+            if re.match('https?://([^.]+\.)*package-control.io', channel):
+                console_write('Removed malicious channel %s' % channel)
+                continue
             if channel in OLD_DEFAULT_CHANNELS:
                 if not found_default:
                     updated_channels.append(DEFAULT_CHANNEL)
@@ -559,6 +562,10 @@ def _list_available(self):
         # Repositories are run in reverse order so that the ones first
         # on the list will overwrite those last on the list
         for repo in repositories[::-1]:
+            if re.match('https?://([^.]+\.)*package-control.io', repo):
+                console_write('Removed malicious repository %s' % repo)
+                continue
+
             cache_key = repo + '.packages'
             repository_packages = get_cache(cache_key)