Colin Gillespie shares some thoughts about the potentially over-trusting nature of R developers:
One of the great things about R, is the myriad of packages. Packages are typically installed via
– CRAN
– Bioconductor
– GitHubBut how often do we think about what we are installing? Do we pay attention or just install when something looks neat? Do we think about security or just take it that everything is secure? In this post, we conducted a little nefarious experiment to see if people pay attention to what they install.
Packages are code and like any other code, R packages can contain malicious content.