Hacker News Reader

Why would a malicious library author limit their maliciousness to the build script?

They wouldn't, but build scripts are a particularly effective attack vector.

They won't, but the less attack vectors, the better.