With npm, pip and random github repositories used for plugins in various applications I tend to disagree. It's not like it is uncommon with third-party additions to package managers such as apt either.
For example i'd trust an apt repository or pip package developed by -say- Blender developers, regardless of it being a 3rd party repository or delivered through pip.
I most certainly trust that there is no ill intent from them and that it didn't raise any flags during testing. But even if I believe they have the resources to audit everything I might be getting a newer and infected version.
And even if my trust of a programmer/entity is rock-solid it is hard to guard against their account being compromised, that is all it takes for most 3rd party sources.
There will probably be quite a few wake up-calls where this is exploited.
Would love if someone would chime in on the reality here.