Clone the repo and ask your llm of choice to audit any security risks
After that I run them in containers, no network access, ro filesystem.
And then build from source. And make sure it doesn't auto-update so no new malware gets in. This is my idea of a lot of extra work.
Why even ask the question?
Building from source is nowadays writing one sentence in a chat box. Your idea of extra work is either unbelievably lazy or perhaps outdated by a few years.
good luck auditing all transitive dependencies
After that I run them in containers, no network access, ro filesystem.
And then build from source. And make sure it doesn't auto-update so no new malware gets in. This is my idea of a lot of extra work.
Why even ask the question?
Building from source is nowadays writing one sentence in a chat box. Your idea of extra work is either unbelievably lazy or perhaps outdated by a few years.
good luck auditing all transitive dependencies