What if it writes to your .bashrc with a malicious alias for sudo?