So, you normally do something like pip install foo, or composer install foo, or npm install foo, or perhaps go get foo, and you never read the source code of the package you just pulled down? Guess what, that's one (almost) sure way to blow up your project!
