> Such attacks would still cause you problems once your audit spots one: you now have to hold back a version That's not a problem caused by this "attack". You

> Such attacks would still cause you problems once your audit spots one: you now have to hold back a version That's not a problem caused by this "attack". You should assume that any open source project you use is unmaintained unless you have a support contract and that it will never get any updates again. A lot of these packages have a bus factor of 1 with no backup plan.