I mean, generally package managers are hosted by a trusted party that screens execs before making them available. But yeah, still think about where you get your software from.