I feel the same way, but you are putting the same amount of trust in external services when you run something like 'npm install' already.

And don't forget that something like:

git clone .... sudo make install

is a huge hole for bad things to happen as well.