Universal Plugin Repository

[Venson]

You should only ever and absolutly ever add those package sources you absolutly trust. If one of those sources have malicious intend, they could potentially inject any code to run on your server by faking a plugin and you are also exposing the existance and ip of your instance to anyone in that list also making you a potential target.