I have this same problem with Python apps. One has to verify if the dependencies are acquired in a reasonably secure way, because security is a second (nay third) thought for developers.<p>It also makes it difficult to do offline builds.