The same way you'd handle a trojan module in a statically-linked project; you remove the trojen and republish. It's a issue with linking rather than dependency satisfaction.