The problem is definitely real, I'd hope that as the ecosystem matures we come to better solutions. Microsoft and google are pretty heavily invested these days so I'd expect they'd be able to provide some clarity here.

I think we just need to push a culture of writing your own code for small things you're pulling in. (of course that just is pulling alot of weight :) )

I just get tired of everyone trying to burn down crates.io as an inherent evil.