... but if I'm installing curl or jq or similar, I'm quite familiar with the provenance of the project, and of the tarball I'm running a configure script from.

... but if I'm installing curl or jq or similar, I'm quite familiar with the provenance of the project, and of the tarball I'm running a configure script from. And maybe I need to install one or two dependencies, similarly they should be familiar, or small and comprehensible, and only downloaded and installed with my explicit actions. (And yeah autoconf generated configure scripts are crazy huge and baroque, and could easily be 1/10 the size for the needed functionality, but compared to "npm install" I'll take it.)