Essentially this is was distributions such as Debian do for your (if you trust them and their security enough which depends on your requirements). xz is noteworthy because someone spent more than two years trying to subvert this.

Note that the distributions used by package managers such npm, pip, or cargo do not do this. So be wary of the "all old is bad and needs to be rewritten and C does not even have a proper package manager" crowd. (memory safety is a good thing though)

This is not realistic for most startups. You’d spend all your time reviewing packages and no time building.

Or fork and cache with dedicated maintenence, if that's what you were indicating above.