I've noticed that there is some discussion regarding a recent change to the Moq framework - probably the most widely used Mocking library in the .Net space. It seems this open source project has now added a reference to a closed-source and obfuscated DLL from a third-party, SponsorLink, which scans your Git config to locate an email address, and sends a hash of this to its servers. It seems people are investigating this further to fully identify any potential data privacy issues.
This approach would disqualify it's use in most companies I have worked with; hopefully this does not become a trend in open-source.
How do you handle security compliance (and licensing) of such third-party libraries at your company?
Personally I prefer NSubstitute for syntax, but as Moq is so widely adopted, I have tended to have used it in the past.