It's pretty easy to hide some questionable code or a questionable new dependency in a decent size PR, and even in a small PR if you're clever. You're likely to

It's pretty easy to hide some questionable code or a questionable new dependency in a decent size PR, and even in a small PR if you're clever. You're likely to get caught eventually since your name will be attached to the PR, but especially if you use some kind of latent trigger, it's very unlikely it will get noticed beforehand.