You are definitely not the only one.

It's wild to me the extent to which some devs just sorta volunteer for RCE.

And often, for the most superficial of reasons? "Oooh, this plugin adds emoji error messages!" one hundred and forty-three black-box dependencies from anonymous github accounts later...