Comment by westmeal

This sounds like you shouldn't trust untrusted code. The only real attack vector I can see is if something fucks with MELPA packages that a lot of people use I guess.