

If it’s a package I’m not familiar with and is relatively small/unknown then I’ll give it a brief once over to see if there’s anything that sticks out (obfuscated code, making http requests when the package should never do that, etc.). Most of the time though it is just trusting the FOSS community.
Yeah that’s cause they’re using ancient systems that probably store the password in plaintext. If you absolutely must use it make sure that password is only used on that specific site. I would strongly recommend looking for other ways before you do though.