No there isn't. In fact proprietary projects are very happy to run "npm" or "pip install" or the java/go equivalents and install whatever. I expect most projec

No there isn't. In fact proprietary projects are very happy to run "npm" or "pip install" or the java/go equivalents and install whatever. I expect most projects don't even check they're not violating licenses or ever audit any dependency… let alone do a security check on who the authors are. Also just FYI, russians are not stupid. If they want to contribute malware they won't do it from their kgb email address. They will create a fake identity with a very standard WASP name.