At the end of the day we have to have trust in others especially in opensource.
Everything you incorporate in your apps/sites could be malicious.
Re binary blobs - honestly, for me at least, if I'm installing a blob it's probably because I purchased the software. Maybe it's naive but I more or less assume no company is going to actively screw over a paying customer