I agree that the red alert looks scary. I wasn’t aware this was what the app looked like while I was still figuring out my open-source strategy. I think I will delist it for now. Thanks for bringing this to my attention. Unfortunately, just because a developer publishes source code for the app doesn't mean that's the source code you downloaded in the app. This is a complex problem that I’m not sure is solvable.

Isn't this is what the APK signature is for? To make sure the apk package hasn't been tampered with after publishing?