Assuming they do proper due diligence and third party tracking just search the database for the ten libraries they use in the most places themselves ... and yes

Assuming they do proper due diligence and third party tracking just search the database for the ten libraries they use in the most places themselves ... and yes, that will need some time to coordinate, for identifying the right people in the open source project. But as they certainly depend on quite a few good relations is also in their interest to deal with security issues.