Is it dangerous to use http-mirrors of repositories on the server instead of https? Is there a risk that packages could be tampered with?

Question

linux

For example, if certain intruders are interested in the machine

Answer 1

The question is incomplete without specifying a package manager.
For example, here is a translation of Debian's position explaining why they are in no hurry to transfer the transport layer to https.
If the package manager you are interested in also verifies downloaded packages, then the conclusion will be the same: it is safe enough.

Answer 2

Safe unless you disable GPG signature verification

Answer 3

1. if there are such concerns, then it is better to use your own mirrors.
2. manually verify packages before installation after downloading or building from source.