Some languages do all kinds of arbitrary things during package installation so the lowest common denominator is "the package manager can execute arbitrary code

Some languages do all kinds of arbitrary things during package installation so the lowest common denominator is "the package manager can execute arbitrary code that does anything" unless languages change their designs to something more restrictive. Python is an example of a language that can (and historically has) done arbitrary things in package installation https://stackoverflow.com/a/43350802/2751619 https://stackoverflow.com/a/43350802/2751619 I think things have improved, but you didn't used to be able to build a dependency tree without installing all packages and iirc there was a dependency resolution case where pip would download every version counting backwards until one happened to install