"How do Linux/Mac package managers solve this?"
By building their binaries from source and hosting them on their servers?
By building their binaries from source and hosting them on their servers?
Which is one of the reasons why a lot of people promote that openness.
If you want to use that suspicious tool, you should at least take a glance at the source code.
You're right, (not just) online AV multiscanners are also FUD machines that will happily accept malicious programs but reject anything well crafted and optimized because it doesn't like exactly like the shit MSVC craps out with default settings.
> Wouldn't help if the source code already has the backdoor in there though
I'm not sure if you're aware but random tools don't just spawn in official package repositories overnight.
There's a vetting process, for both new packages and new maintainers. Also in established distros, packages don't get accepted to official repositories unless it's a critical and highly demanded one.
So yeah, any software can have vulnerabilities, regardless of OS. But stray tools and dubious actors, are pretty much a solved problem in linux distros. The situation on Windows is laughable in comparsion. No need to spread FUD.
Pretty much, packaging is not a brainless process. One of the effort that specifically target this is the Reproducible builds project [0], along with many other security measures set by each distro.
There are also usually multiple testing and updates rolling stages.
The best evidence of how effective these measures is its actual reputation and record on the ground.
You also have the option of building from source yourself. Some package managers and distros (Gentoo, NixOS, Guix) do this for you.
This is BTW the main reason I wouldn't use derivate distros for anything serious.
Debian's generally trusted in the community - their slow pace come from risk-aversiveness.
The question asked by parent comment was:
"How do Linux/Mac package managers solve this?"