There are thousands of tools (shellscripts, makefiles ...) which execute "python -m": https://www.gnod.com/search/?engines=af&nw=1&q=python%20-m https://www.gn

There are thousands of tools (shellscripts, makefiles ...) which execute "python -m": https://www.gnod.com/search/?engines=af&nw=1&q=python%20-m https://www.gnod.com/search/?engines=af&nw=1&q=python%20-m Even in Google's own repos. Starting any of those (no matter where they are stored) in a hostile repo would let the code in the repo take over the machine.