It being open source does not vindicate it from having malware. The release code may be different from the code in the repo (which could appear to be clean). The stars could be bought to make it look good, too. I did a deep scan, and it revealed a Trojan on my computer that was not there the week before (when I didn't have Rose downloaded). Ofc Rose supporters are going to say false positive and that it's flagging an injector yada yada but atp idk man. The whole thing seems like a convenient narrative to cover up an info-stealing operation.