A writer lurking.
The thing with ‘malware’ in free/open software is that you CAN (or somebody else will eventually) discover it, if such slipped by.
There’s no such choice with closed-source, where the seller/corporation often serves you Trojans intentionally, unknown to you (for data collection), and then even asks you to pay often for such a spyware.
I think something like adding movie cataloguing functionality to https://inventaire.io could be easier…? They claim to support ActivityPub too as of now…