hmm even though the code is open source, how do you know that the published extension is bundled using the same code as what is open sourced? I guess I'm trying to say you'll have to be okay with some level of trust here unless you clone the open source project use it to load an unpublished extension for yourself