You can't really, but at some point you have to trust someone, otherwise everyone would recreate everything from scratch. Though TBH what i had in mind wasn't r

You can't really, but at some point you have to trust someone, otherwise everyone would recreate everything from scratch. Though TBH what i had in mind wasn't really the "let's download live code from random places" repositories like npm and pip, but more "static" repositories where all dependencies are either part of the repository itself or assumed to be already on your system.