When we clone git projects to use as is or when we install free npm packages provided by third party sources, is there any security risk? how trustworthy such packages are for production environment?
Of course there is a risk.
Floss software doesn't eliminate malware, it just makes recognizing it possible. For a well-known big project, there will be some people looking at the code all the times, so that no single person can ever do anything bad. For smaller projects, you would need to check yourself if you want a guarantee that it is fine.
And, of course, bad sourcecode is not the only problem. Sourcecode can be not the one used to compile the binary version. Or, if you compile it yourself, there's even a (small) risk of bad compilers (while even the compiler source is completely fine - describing this goes to far here). And it doesn't have to be the author of the program, third parties can comprise the server too, or tamper with connection data etc.
Especially on npm there were known active attacks. The package cross-env was useful and used by many users, but the package crossenv would leak all your environment variables to another host.
Someone took this to the extreme by registering a lot of packages in a lot of systems, which could have resulted in the compromise of 17000 hosts.
Furthermore, someone showed that some NPM accounts used weak passwords, which could result in distribution of malicious code.