Dependencies Are Someone Else's Attack Surface (quodeq.ai)

But your responsibility. You should be able to or at least understand, have a fallback if your dependency becomes at risk. You should have a plan B for when such attack occurs.