If you're (rightfully) concerned about this stuff, i'd suggest:
Asking for the source code, perhaps in the form of an online repo (github/gitlab/bitbucket/...)
Perhaps build your own jars from said source code if you're confident you know how
Decompiling the built jars that are sent to you before running them
There are plenty of free decompilers available online, or alternatively you can install IDE plugins if that is your thing.
Running the code by a scripter on here to double check
GL!
Apa