I am pretty sure the distro packagers all know where to get the real code from, and its packaged for everything that runs X so minimal risk.
Also assuming something on github is the official repo is dangerous anyway. There might be multiple repos with the same name, there might be a more actively developed fork and the official one might be unmaintained, etc.
Also assuming something on github is the official repo is dangerous anyway. There might be multiple repos with the same name, there might be a more actively developed fork and the official one might be unmaintained, etc.