Compromised third party libs are absolutely not “an unexplored area around security”. It’s a super well-known threat.