Generally speaking. You shall not download code from somewhere else and execute it blindly. Always lock the solver. You can automatically scan definitions for custom code:
This is not bulletproof, but its better than nothing.
Other than that, always question the value of a dependency. Developers can also break your system unwillingly or introduce malware through introducing compromised dependencies. Most plugin developers are not professional software engineers, and might not even notice that they break a system.
Zero trust is important.