OWASP Cheat Sheet is what I’d start with. OWASP SAMM and DSOMM if you’re looking something beyond just coding that covers everything a business should be doing and DevOps respectively. Beyond that please tag me if you find something good that’s language specific. More on reddit.com

The only sure way to know is to look through the code directly, though that is a real pain! When I'm trying to determine if a repo might be malicious, I typically look more at who has written it to try to judge if they might be doing something shady. For instance, do they have any other popular repos? Do they work for a credible institution? In general, I tend to trust science repos more than those in some other fields because the authors typically have a specific goal and the potential targets for malicious code (other scientists) is pretty small. Another option that could be interesting for you is to run the repo from something like a docker container which would put another layer between the code and your machine. More on reddit.com

There is not a good answer. The only way to really be sure is to become knowledgeable in the language and security and audit it yourself. Practically speaking this is an exercise in risk assessment. You look at how popular it is, how sketchy it looks, what permissions it needs, what the impact would be if it was malicious, what your alternatives are, what your own knowledge is, and you balance out all those things to make a decision. It will be different for everyone. More on reddit.com

You've asked a super important question. I've been lead on security projects and audited in this way. It's a fucking horrible process. Other than keeping a known, saved, local copy of any particular package, its a real challenge. More on reddit.com