And, you know, let's say you have all the time and patience in the world and you download the source and read it carefully and determine it's not malicious...

I believe there might have been a lecture/paper about this once.

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

(I can just hear them damn kids standing on my lawn chanting "You can't spell 'trust' without 'rust'!")

I keep trying to give VSCode a go.  It seems really nifty.  And somehow I keep bouncing off and landing in Emacs, every time.  Maybe when I finally get around to writing, rather than cargo-culting TypeScript, or Unity/C#, it'll be a better fit.  But for my current life, which is mostly Python...I appear to be sticking with Emacs.

Adam