Probably hard to do during nine-to-five, but personally commit to being a contributor on every dependency used.<p>Like having mini contracts with every package, even if it's just to reproduce bugs, maintain a personal test suite, or to steer newcomers to resources.<p>Otherwise, we will always be in the dark about our dependencies, building our flying castles. (They float, but where's the foundation?)<p>Alternatively, there are open-source code scanners and bill-of-material security tools. Those could be added as triggered workflows in your projects, to run on each pull request.<p>As well, the author did rewrite dotenv's core features to replace it.