This seems to be tending towards the generic problem of permissions that we have seen previously elsewhere. For example in the case of Facebook, it used to be

This seems to be tending towards the generic problem of permissions that we have seen previously elsewhere. For example in the case of Facebook, it used to be that users would accept permissions without considering them, and in-turn, various apps would access their data in bad faith. Likewise for mobile apps. Eventually Facebook removed many of the overtly powerful permissions entirely, likewise with the mobile operating systems. In the case of mobile, the concept of "runtime permissions" was also introduced that required explicit approval to be granted at the time of authorization. On Android, location access now prompts the user in the notification area informing the user of an app that accessed their location. Can some of these ideas be borrowed to the package/dependency management world? "The package you are about to install requires access to your hard drive including the following folders: x/y/z/all?