you might be also interested to check perlsec when handling taint.

searching for "require" produced https://perldoc.perl.org/perlsec#Taint-mode-and-@INC

Note that if a tainted string is added to @INC, the following problem will be reported:

Insecure dependency in require while running with -T switch

---

I'm not sure tho, why using diagnostics or splain don't show this.

Probably a worthwhile feature request to add above information to https://perldoc.perl.org/perldiag#Insecure-dependency-in-%25s

---

update

OK, got it ... the Insecure dependency in error will be thrown on multiple occasions, not only in require :)