I'm looking at emacs helm specifically, which has the following properties:
- it has thousands of commits
- it is largely maintained by one user
- the maintainer has no other profiles (social media, etc.) I was able to find on a few searches
- it is actively maintained (today)
Since I'm about to install arbitrary code on my computer to use in my text editor, I wanted to verify if this has undergone any review process. I'd like to say "well it's open source" but I really am far from the elisp ability to audit all the code myself. I would like to assume others in the community have reviewed it but one that's probably false, and two there are up-to-the-minute commits. Are there other strategies I am missing?
For the record the vector is simple: "open source" doesn't matter all that much if the contributor is working under a throwaway account, or if there's no review process.