Lots of cool stuff that I happily use, but the bar to installing something that gets to see my password (OS, terminal, input handler, etc) is very high.
Not a popular take, but I'd rather run something from Valve or Google for the same reason. I trust there to be more vetting if a corporation is putting its reputation on the product than a toy I found on GitHub.
It's a bit of a myth that open source leads to more eyes on the software. Most people just install it and trust that somebody else did the audit.
Something with a vibrant community of maintainers? Maybe.
Something that's too big to personally audit but too small for that community? I'll pass.
At least with open source you have a chance to prevent this. With proprietary its pure trust.
It can happen anywhere, really
The problem isn't the open source (in fact, that's better). The problem is downloading random shit from the internet, and the biased assumption that open-source == trustworthy.
Debian repos are not NPM. Yes, the package are actually vetted to some degree.
I agree, there are companies I'd trust but most software isn't made by Valve and Google. There are plenty of developers also not auditing their dependencies.