And, you know, let's say you have all the time and patience in the world
and you download the source and read it carefully and determine it's not
malicious...

I believe there might have been a lecture/paper about this once.

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

(I can just hear them damn kids standing on my lawn chanting "You can't
spell 'trust' without 'rust'!")

I keep trying to give VSCode a go.  It seems really nifty.  And somehow I
keep bouncing off and landing in Emacs, every time.  Maybe when I finally
get around to writing, rather than cargo-culting TypeScript, or Unity/C#,
it'll be a better fit.  But for my current life, which is mostly Python...I
appear to be sticking with Emacs.

Adam