yeah, I tend to only look at repos with decent activity. If I stumble across a project that seems a bit sparse but I still need/would like to use the code, I try to scan through it myself to spot anything fishy. So far so good, but always good to be careful and triple check