I stick to official distro packages from distros I like, mainly Debian and OpenSUSE. Community packages are too sketchy for me, and I consider downloading packages from sourceforge/etc to be a Windowism. And while it's possible for a malicious entity to infiltrate the ranks of distro packagers, I think the threat of the developer selling out has proven to be more likely.