The problem is that open source software is inherently trust-driven. I wouldn't blindly execute any random code on my machine, but I execute code from people or

The problem is that open source software is inherently trust-driven. I wouldn't blindly execute any random code on my machine, but I execute code from people or companies I trust all the time. Of course I could review the whole repo, but that always takes time (and even then you're not guaranteed to not be hit by an intentional/unintentional vulnerability), and it comes down to "well, would me spending time vetting this be more valuable than just finding a more popular, more trusted alternative?" So it's hard to spotlight anonymous devs on their own, because you can't establish trust with someone who isn't known for anything yet.