To what extent is the code of the packages included in
tex distributions reviewed with respect to malicious code.
This is with respect to what is posted in documentation as well as what is actually used in the distribution.
TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. It only takes a minute to sign up.Sign up to join this community
Simple answer at least for TeX Live: no review. Reviewing daily tens of package updates is impossible.
We do review packages/programs that we put into the shell escape allow list, but nothing else.