Other languages with dependency management frameworks (Java with Maven Central) go about this a little different: you can download as many evil dependencies as

Other languages with dependency management frameworks (Java with Maven Central) go about this a little different: you can download as many evil dependencies as you like, but unless you actively execute them, nothing will happen. There are some caveats, especially with nasty frameworks that scan the entire classpath, but that's a different issue.