Similarly, running "make" in the directory of a freshly downloaded repo is dangerous too. It's really difficult to check all code running on our behalf and to q

Similarly, running "make" in the directory of a freshly downloaded repo is dangerous too. It's really difficult to check all code running on our behalf and to quantify the risks. If someone take control of a popular git repo and push a malicious build script. How many people will be affected before the fix ? But this doesn't seem to happen very often too.