I work with C#, most (all?) Nugget packages I download are open source, which isn't the case of a lot of WP plugins that are obfuscated. They're also centrally

I work with C#, most (all?) Nugget packages I download are open source, which isn't the case of a lot of WP plugins that are obfuscated. They're also centrally managed by Microsoft, so if there was a problem with one package they could kick it out of the Nugget repo. But in the end you're right, it's mostly a matter of trust and finger crossed.