> Unfortunately, this is how I found out 10 years ago when someone hacked a 3rd party dependency I was using on my site.

Better than a customer telling you they got a nasty bug from your site!