If you don't personally review every line then you are already trusting blindly.
I trust that Linux has a process. I do not believe it is perfect. But it gives me a better assurance than downloading random packages from PyPi (though I believe that the most recent release of any random package on PyPi is still more likely safe than not--it's just a numbers game).
https://blog.yossarian.net/2025/11/21/We-should-all-be-using...