pannallas

You can't trust open source repos either; you can only verify them.

And is anyone really reading all of the code they run before they run it? With all of its third-party dependencies?

I don't think open source repositories are safer because they're open source, but precisely because there is no commercial benefit to shoveling BS into them. In fact, with the bigger commercial open source software, you often do see crap you don't want being included as a means to funnel users into commercial channels.