Am I the only one who thought that by using github links for an dependency source is not a wise thing to do? Do folk not understand that by doing so, you're en

Am I the only one who thought that by using github links for an dependency source is not a wise thing to do? Do folk not understand that by doing so, you're enabling modules to maliciously write themselves in to your code?