Technically, yes you can. But do you really have the time to sit down to understand a piece of software enough to know if it's doing anything nefarious?
True. But I think they have the means to do that on a lot of (non-russia-associated) repositories. They even probably wouldn't pick this one because it's under too much scrutiny.
