There is plenty of info on how to use what seems to be third-party packages that allow you to access your sFTP by inputting your credentials into these packages.  
My dilemma is this: How do I know that these third-party packages are not sharing my credentials with developers/etc?
Thank you in advance for your input.
Thanks everyone for comments. 
To distill it: Unless you do a code review yourself or you get a the sftp package from a verified vendor (ie - packages made by Amazon for AWS), you can not assume that these packages are "safe" and won't post your info to a third-party site.
Security of SFTP packages in Python