In order from the most to the least secure:

• distro repos: there is a process that is supposed to ensure no malicious changes make it through. Usually far enough behind recent code changes for new issues/code being compromised to be spotted
• official package outside distro repos if packaging org has secure release workflow
• building from source / official package on external repo if you know little about packaging org: malicious contributor or a compromised account is enough
• unofficial package: like building from source, but you have to worry about package maintainer too