Comment by alexchamberlain

For a source package based on setup tools, setup.py is executed with a minimal environment and can run arbitrary code.