Suppose that the sole developer of a niche open source project available from an official Ubuntu repository gets to sneak a malicious commit into their project, making the otherwise useful program act as a keylogger and send the collected data to the project's server along with benign and expected data queries, or perform any other similar and clearly destructive activity.
What layers of security does Canonical provide to avoid that? Is the code available from the official repos independently audited? What if the package maintainer is in cahoots with the developer, or is the same person?
