What happens if a package is depended on but contains pirated things?