cargo-crev

the idea is valid, but current LLMs suck, as the sibling comment says, they hallucinate too much, etc. that doesn't mean they won't improve enough in the next decade (especially coupled with clever loops, where the generated code is checked, end-to-end tested, static analyzed) but this also shows what's really missing from these old projects, infrastructure, QA, CI, modern tools, etc. and adding these requires humans in the loops, and every change needs to be checked, verified, etc. and it's a hard task for a loose community of volunteers. even the super fancy Rust community kind of shrugged and let crev die silently https://github.com/crev-dev/cargo-crev

instead the downloaded malicious code runs in prod. maybe, if you are lucky, it does something strange in CI and you can catch it. the only real solution is a reputation system (like https://github.com/crev-dev/cargo-crev ), which of course is unfortunately barely used

It's a decent starting point, but it's an assumption that they're not collecting data (because it is discoverable if it's written in the code); however is not always true. You should check the source code for every project you're using as much as possible to really ensure that there isn't anything obviously nefarious like telemetry included, because in some cases it's still there. See Sunxi's Linux SBC backdoors on git for one of many examples of undocumented insecure or privacy-breaking code. In other cases it may be more documented, such as Golangs baked-in telemetry. There should be better ways to check these problems. The best I have found so far is Crev https://github.com/crev-dev/crev/. It's most used implementation is Cargo-crev https://github.com/crev-dev/cargo-crev, but hopefully it will become more required to use these types