> dependencies for the build from a package registry like npm, pypi, or crates, it might download and apply patches, and run arbitrary build scripts

You're supposed to review every single one of those too.