If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle.

If someone's really truly trying to hide malicious code in plain sight, then you probably won't notice it. Take for example, the infamous [2003 nearly-a-backdoor in the Linux kernel][1] where this harmless code:

    if ((options == (__WCLONE|__WALL)) && (current->uid == 0))
        retval = -EINVAL;

was turned into a backdoor like so:

    if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
        retval = -EINVAL;

(hint: instead of checking if you're root `uid == 0`, it turns you into root `uid = 0`. So pass in the flags `_WCLONE|_WALL` to whatever system call this is and BAM! you're now root.)

This example isn't directly relevant, but shows that malicious code in C/C++ can be _really_ subtle. So if you think there's a chance that someone is playing hide-and-seek games in the code, move on and find a different project.


----------

I often deal with a softer version of your question, "Is this open source library / tool ok to use?". My approach is to see if it has a good reputation; is it actively maintained? Do their github tickets give the impression that they follow a proper dev process? Do they publish regular changelogs, including security fixes? Are the binaries properly code-signed? It's not foolproof, but it weeds out seedier projects.

(if anyone has a better way of vetting open source projects, I'd love suggestions!)

  [1]: https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/