You can trust community as the whole, because uses it own product. Community will protect itself, so you, as regular user, can benefit from that for free. No community - no protection, because the owner of a package is not a user of the product.
Case in point that gets at both: malicious python and npm packages stealing credentials. They were caught and handled, but not before hitting some people.