Proc macros can do anything, but this is not meaningfully different from mechanisms in most packaging ecosystems: Python runs arbitrary code (via `setup.py` or

Proc macros can do anything, but this is not meaningfully different from mechanisms in most packaging ecosystems: Python runs arbitrary code (via `setup.py` or a potential in-tree build system) when you install a source distribution, Ruby evaluates the Gemspec's source code, etc. Even Rust has plenty of avenues for arbitrary install-time code execution: `build.rs` runs as arbitrary Rust code without a sandbox, regardless of any proc macros. (This is not to say that any of this is good! But it's worth having a full picture of the status quo.)