I'm note a programmer. I Don't Understand Codes. How do I Know If An Open Source Application is not Stealing My Data Or Passwords? Google play store is scanning apps. It says it blocks spyware. Unfortunately, we know that it was not very successful. So, can we trust open source software? Can't someone integrate their own virus just because the code is open?
Yes, however there are ways of verifying that. Compiled programs are not black boxes, they're just complicated enough that we can consider them beyond human comprehension (at least complicated programs), but they're very much readable. Which means programs can check differences between what should be there and what is. Not to mention that you can also compile the code they said they put there and check for differences with what they're distributing.
Is anyone doing that? Don't know, but because it's possible to be verified it's unlikely that people would try to do something nasty.
Edit: I'm talking about official releases on official channels, download binaries from different sources at your own peril since those are unlikely to be checked, and even if someone found differences they could claim patches or different compilers.