That doesn't seem like as big of a problem, because you, as the user of an open source library, can take steps to prevent such things from affecting you. Most p

That doesn't seem like as big of a problem, because you, as the user of an open source library, can take steps to prevent such things from affecting you. Most places I've worked at have their own repos with copies of any maven/node/ruby/whatever dependencies used.