Maven plugins and extensions can execute arbitrary code, so you should still exercise care when running an untrusted maven project.