You just described a supply chain, and the risks that come with them, which is something every dep management system is dealing with, rubygems, npm, etc Again,

You just described a supply chain, and the risks that come with them, which is something every dep management system is dealing with, rubygems, npm, etc Again, it all comes down to your risk tolerance. There's a certain level of trust built into these systems.