Hmm like building an node project, actually any project can have a dependency on a made up libraries that does the exploitation or even the project itself as made infamous by chrome extensions