Am I the only one who thought that by using github links for an dependency source is not a wise thing to do?

Do folk not understand that by doing so, you're enabling modules to maliciously write themselves in to your code?