How do you ensure supply chain security

[janvhs]

Hi, with all the third party explicit and implicit dependencies you pull in, how do you ensure your supply chain is secure and you don't pull in malicious code?

I'm asking, because I see a lot of really interesting Rust projects pulling in a lot of implicit and explicit crates and I was wondering whether there is an economic approach to reduce the risk, that something along the lines of a libxz, node-icp or color.js is caused by one of the dependencies.

I know it's an emotionally charged topic, but I am genuinely curious about ways to you solve this.

Thank you

[BlackAsLight]

Are you asking how Deno does specifically or how developers do in general?

[janvhs]

Deno specifically