Open source repos should be ok, assuming that their admins don't start allowing this crap in. They haven't done so far, with the one exception of the Ubuntu ama

Open source repos should be ok, assuming that their admins don't start allowing this crap in. They haven't done so far, with the one exception of the Ubuntu amazon thing. A risk might be drive-by malware that adds stuff to /etc/apt/sources.list though, however to do this you would need drive-by malware that can bust into the root account, or to get the user to enter the admin password.