Open source does not equal trustworthy, but open source repositories usually are trustworthy, because they're trusted repositories.

Debian repos are not NPM. Yes, the package are actually vetted to some degree.