Comment Impossible (Score 4, Interesting) 35
I have a student who is writing a paper about exactly this topic. Almost any large project nowadays uses dozens of external libraries, which in turn use dozens or hundreds more. This creates a huge, almost unknowable dependency tree. Any of those libraries may be updated at any time, and be pulled into a new release of your software. Any of those libraries may contain a security flaw that could be discovered and exploited. Any of those libraries may be deliberately compromised - and how would you know?
As a current example, consider the recently discovered flaw in Starlette, which the developer claims is downloaded 325 million times per week. Never heard of Starlette? That's because it is a fundamental building block buried deep in that dependency tree. Despite the title of the article, this flaw affects far more that just AI apps.
IMHO, the best solution - if you can afford it - is to write as much of your own code as you can. Sure, you may also have security flaws, but you are a far smaller and less interesting target. If there is a better solution, I don't know what it is...