again, nothing blocks you to have a better supply chain to your software:

Download all dependencies and freeze them, fork the dependencies and groom your fork or have dependantbot or depfu managing your dependencies for you and keep a delay between merging the PRs, have manual review, etc..

You shouldn't be pulling stuff from internet and pushing to production without take a look into that anyway...