This problem is more far reaching than just extension, and further reaching than what entity is in charge of something. For instance, the worst company imaginab

This problem is more far reaching than just extension, and further reaching than what entity is in charge of something. For instance, the worst company imaginable may be in charge of software that was once FOSS, and they may change absolutely nothing about it, so it should be fine. However, if a small update is added that does something bad, you should know about it immediately. The solution seems to be much more clearly in the realm of things like crev: https://github.com/crev-dev/cargo-crev/ https://github.com/crev-dev/cargo-crev/ Wherein users can get a clear picture of what dependencies are used in the full chain, and how they have been independently reviewed for security and privacy. That's the real solution for the future. A quick score that is available upon display everytime you upgrade, with large warnings for anything above a certain threshold.