Not only that but also the security implications. I always though that is was really crazy that people are just willing to download megabytes of arbitrary code

Not only that but also the security implications. I always though that is was really crazy that people are just willing to download megabytes of arbitrary code from sometimes unknown sources without doing any security audit whatsoever. And when people are doing audits, they most often just clone the repository without checking if the archive on whatever package manager is matching the source code. It’s a disaster waiting to happen.