Anyone can upload to zapstore The one under my name is safe, do not download the one not signed by me

This raises an interesting question. My understanding is that zapstore only shows me curated apps from @Zapstore team and apps from my WoT. So how did this get in there?

No, it shows all apps, but shows you who signed or zapped the app. I don't think WoT filters the apps.

It shows you exactly who it came from and also if it's from a rando on Github