In practice, that doesn't happen often enough to be something I actively worry about. I scan my dependency's source code each time I upgrade, and that's enough

In practice, that doesn't happen often enough to be something I actively worry about. I scan my dependency's source code each time I upgrade, and that's enough for me. The number of dependencies I've had fail in that manner is currently 0. Also, all my open source dependencies have their source-code reviewed regularly by distro maintiners (like debian's), and the last version's source code is available in source control, or at worst in a distro's src tarball mirrors. However, on the flip side, the number of dependencies I've had break because they're maintained by a large company, and that company pivoted in some way, or reworked everything, or in some cases had the code calling into their proprietary backend via some api and broke their api... that number is in the dozens to hundreds. Using a dependency maintained by an entire company vs by a single contributor doing it in their spare time... Well, the company-maintained ones have a much worse track record for me so far.