Hardly. I was on a project with a JS dependency with 6.5k stars and sponsors but it injected a remote script at runtime without consent. I'm also a part of nich

Hardly. I was on a project with a JS dependency with 6.5k stars and sponsors but it injected a remote script at runtime without consent. I'm also a part of niche community circles where a project would be lucky to break 50 stars despite having phenomenal value and quality. It really is purely a popularity contest and only that with a bias towards other languages and projects that are equally as popular.