I&#x27;d prefer to see package managers be more separate. Downloading dependencies involves interacting with third parties and has security implications. That&#x27;s fine when you&#x27;re downloading software intentionally from a source you trust, but I&#x27;ve had the experience of downloading source code and noticing that the build system is downloading from sources I don&#x27;t recognize or without https, and that&#x27;s not so good.