Over the past few years, I've seen several github projects that won't build because they rely on private libraries that are downloaded at run-time. I've opened

Over the past few years, I've seen several github projects that won't build because they rely on private libraries that are downloaded at run-time. I've opened a few of the downloaded libraries, and they're always innocuous. Often, they are just compiled versions of source in a different repo under the same author. But, that mechanism could easily swap the library for a trojan. It's really absurd how many of these are out there in the wild. Scary really.