The whole point of Python is that you don't need external dependencies for "small tasks and scripts".
A production "script" requiring downloads of third-party code from external servers is already a red flag, by the way.
A production "script" requiring downloads of third-party code from external servers is already a red flag, by the way.
In principle, there's no reason why the same supply-chain security mitigations npm and other package managers / repositories have put in place could not also be applied in this case: you just apply them at download time, same as before, except now it might result in a runtime error instead of an npm install failure. (No idea if deno does this in its current state, tbh.)
Agree, however, that blindly executing third-party code without somehow vetting it is a security risk.
Also, re: Python - there's a reason why libraries like requests exist; while the Python Standard Library is pretty comprehensive, the APIs it exposes are not always the most intuitive. You might be surprised at how often people pull in helper libraries to work around some of its warts - now, one could argue that maybe they shouldn't do that and should just know the built-in modules better, just as one could argue that functionality is useless unless combined with usability.
When you download a software update for your kernel you are trusting the Linux Foundation and your upstream vendor. They are supposed to have proper processes in place, they sign the binaries and may even have a support contract with you.
When you put a random URL as a dependency, you are just trusting some random person over the Internet not to screw it up.
Re: Python libraries. The topic of this thread was about "small scripts and tasks". The point of Python and its "batteries included" is that you don’t need external libraries to accomplish common tasks. It is a mistake to use external helper libraries in your scripts (not apps).
And I wasn't implying that production scripts shouldn't be self contained. Just placing my 2 cents on why.
Mind you, your Python runtime has been vetted by the Python Foundation, your upstream vendor and your company; is used by many other companies and does not require any network connections to run.