This is what [big] Linux distributions are for: vetting packages and vetting the vetters.