It's yet another surface for dependency attacks