How to prevent 3rd-party JS code from making an HTTP request from my web app?

A Node-based web app with an SPA framework (e.g React) imports hundreds, if not thousands, of 3rd-party packages. I have no hope of reviewing all that source for security vulnerabilities and zero-day exploits mean patches can come too late. I'm particularly worried about HTTP requests being made by code that would collect and send user data to outside services.

I would like to prevent any code in 3rd-party libraries making HTTP requests, whether it be through calls to fetch(), XMLHttpRequest, form-posting, or any other means.

I can imagine wrapping fetch and other functions with my own versions of these that effectively make it so that only my app's code can use them.

Still, I worry there will be attack vectors I'll miss, especially around DOM manipulation where elements could be inserted like image tags that cause an HTTP request that sends a payload in the querystring.

I'm interested in build-time (static code analysis), as well as run-time solutions. And if there is existing software that handles the task, so much the better.