ASAP pls

Tom is working as a system administrator for a company. His job includes necessary sotware installation for other employees to use. One day, he received a request to install an open-source sofware package from a website. Before installing the software package, he wants to make sure the software package is free from unwanted malware. specifucally, he wants to maintain the level of coincidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its lifecycle, and that the software functions in an intended manner. What approach does he need to follow to support the level of coincedence of the software package?