Does karabiner elements on Mac OSX contain, or potentially contain, malware?

Question

I'm using Karabiner elements, an open-source program to remap the keys on my MacBook Air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely.

However, I am concerned about the off chance that a malicious adversary can possibly use it to record keystrokes and passwords. This question was already asked on a Google Groups thread, and the creator of Karabiner answered. While there doesn't appear to be any reason to suspect that the creator of the program has anything other than good intentions, I would feel a lot more comfortable with a more independent assessment of this question.

Some further info: the Github page for the project has a decent number of contributors, and the creator of the program appears to be someone who I have no reason so far to suspect. However, I'm not as experienced in the world of open-source software development as some others here may be, so I was hoping someone with a better background can shed some light on this issue.

Answer 1

I am not sure anyone here would be willing to read through it but my advice would be:

1. Read through the bug reports

2. Research information on it and read as many reviews as you can. It has a lot of eyes on it, but it is easy to be sceptical.

3. You could always sandbox it and monitor it, but that's still not a sure way

Long story short, unless you read the code yourself or find someone reviewing the code, you will just have to go with your gut. It has a fair amount of popularity.

Not a lot of people read the source code of something open source. Because it' s open source, they automatically trust it. So it is good you are sceptical. 'Open source' does not mean 'safe', as you seem to be aware.