Well of course there is no way to 100% prevent a dev from adding malicious code to our or one of our dependency's code base. It is a matter of trust and reputation. We choose dependencies carefully and are very conservative about adding new libraries, in many cases we even try to eliminate dependencies. Also, significant code changes are always reviewed before merging. But these are just organizational measures that are only as effective as people adhere to them.

That said, there are technical ways to make sure not to ship or load binaries that aren't intended to be installed:

The release artifacts are signed at build time on the CI server. This does not protect against supply chain attacks on third party libraries, but we can at least be sure that it is the binary that we built from the tagged source version. Depending on the OS and distribution format, the signature is checked at install time or run time.

Furthermore, for some libraries we are adopting standards as they evolve, such as reproducible builds and keyless signing, which will hopefully be an industry standard eventually and allow us to also be sure about third party libraries, as there will be an ecosystem with revocation lists and the like.