How do you all go about validating that there’s nothing malicious in your nuget packages?

Is there a best practice for this?

It’s easy if the package is from a known source like Microsoft but I’m curious what you do for lesser know people?

I will usually see how many others are using it, probably scan the code in the GITHUB repo. Sometimes if it’s a lesser known dev I’ll just pull from GITHub rather than using NuGet.

Today however, I was looking at a package and the nuget package itself looks fine but it contains some C++ code that is compiled elsewhere…fine I’ll go get that and see. But that code requires CMake and some other 3rd party add-ons which I also have to review.

I’m not aware of any audits on NuGet that would prevent bad people from uploading code. What do you all do to protect the integrity of your software?