Actually, even with opensource you may never know it happened. Does not matter where it comes from: - They have to find it out first. - Then they've to be wil

Actually, even with opensource you may never know it happened. Does not matter where it comes from: - They have to find it out first. - Then they've to be willing to disclose the incident - Even if, you still trust the source of the packages, the developers, etc. There's a zillion bugs that look like "just an error" which can also be "just a backdoor". For these reasons, running mac, checking modified files, etc is ALWAYS good practice (that you seem to follow, don't get me wrong - but that's pretty rare)