In JavaScript just the npm install can fuck things up. Pre-install scripts can run malicious code.