I just installed several vim plugins using `vim-plug` and was wondering how to prevent random malware sneaking its way into my vim setup. As far as I can tell,

I just installed several vim plugins using `vim-plug` and was wondering how to prevent random malware sneaking its way into my vim setup. As far as I can tell, vim-plug just goes to the github repo you are telling it to install and just installs whatever is there as a plugin. Is there some way to set a commit ID or version it should use?