Comment by dvh

Errr, you! If you brought the dependency, it is now your job to maintain it and diff every update for backdoor.