One could also think that whoever packaged this was hurried while filling a form, and wanted to provide credit where it was due. So, maybe they were on the best of their intents... We don't know.

If I were to use this, I would check other apps from same uploader. Or better, see what permissions are being asked..

In any case, trusting blindly github contributors on teamnewpipe organization is not extremely different.

Trust and credibility are volatile and freely given. It's youtube, not my bank account ;p