“The code that's coming from the PR, that's, from someone that forked it and opened the PR, you need to consider like, toxic waste.”

Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.