How does this differ from any other software? Either you trust the author, or you don't. I assume you haven't reviewed your entire stack to prevent it from including evil code?