Only if you ignore the "npm install" or "pip install" moral equivalent. Free open source packages that come with a side helping of malware have become common in recent years.