There are projects like crev [0] which attempt to get around this by using a web of trust to audit dependencies. Rust has cargo-crev [1] as an implementation.
Here's the previous HN discussion [2].
[0] https://github.com/crev-dev/crev/
Here's the previous HN discussion [2].
[0] https://github.com/crev-dev/crev/
But it looks like crev deals with this by allowing users to choose their circle of trust, which is an interesting concept, definitely following this project and will take a deeper dive into it. Cheers :)