I think there’s already a big market of supply chain security companies that are proactively scanning dependencies for this sort of thing.

They’re always racing to be the first one to write an article about a case.