I am aware that the downloaded dependency is only run in a sandbox, but as a matter of principle I think it's not a good idea to run code from an untrusted source. I'd suggest to compute a checksum on the downloaded tarball after download and only continue if it's the expected value. Since the tarballs seem to be versioned, I wouldn't expect it to change. Just my 2 cents.

I am aware that the downloaded dependency is only run in a sandbox, but as a matter of principle I think it's not a good idea to run code from an untrusted source. I'd suggest to compute a checksum on the downloaded tarball after download and only continue if it's the expected value. Since the tarballs seem to be versioned, I wouldn't expect it to change. Just my 2 cents.

good point ;-). The issue is solved in PR #36