With a large project unless a large auditor goes into your code and reads it with a fine comb it's not a good idea to have blind trust in it. And Chinese autho

With a large project unless a large auditor goes into your code and reads it with a fine comb it's not a good idea to have blind trust in it. And Chinese author does mean CCP, assuming they live in China they are almost certainly able to be compromised and it is a bad decision to trust them with something as valuable as your whole code base.