Are you serious? It's open source. And there's less than 1000 lines total. Get Codex or Claude to review it if you're paranoid.
I don't even think notarization gets rid of this problem neither, so the best you can do for this is compile it yourself. Maybe I'm wrong!
That's what I do with every project delivered as docker image. I rebuild the app and the image.