Running what you've built when you've added a malicious dependency also causes arbitrary code execution.