This is more like adding a third party dependency to your project without vetting it.