Whoever terminates this http request gets to run arbitrary code on my computer that I haven't read, in the context of my user
I suppose perhaps you could read all code you use before installing it, but I expect the number of people who do that rounds down to zero.