Ask HN: How do you deal with the fear of installing potentially risky tools?

There are some open-source tools—popular and widely used—that I’m honestly a bit scared to run on my work laptop (since it has access to credentials, production servers, etc.). For example, I always feel a little nervous about installing something like k9s.

This all started after the xz backdoor incident. Since then, I can’t shake the thought that if I install the wrong thing, it could mess things up really badly. At the same time, these tools could make my life at work so much easier.

Emacs is another example. With or without packages, it installs a bunch of stuff I don’t really understand. Because of that, I usually just stick to the basics: VS Code, Terraform, kubectl—tools I feel safer with because they come from well-known sources.

So I’m curious: how do you deal with this? Do you ever worry about your work machine getting compromised because of an open-source tool you installed? Any advice is appreciated.