I actually think there is room here for an upgrade "helper" or wrapper (yeah I know, I'm gonna try to solve npm package problems by making a new npm package!)

I actually think there is room here for an upgrade "helper" or wrapper (yeah I know, I'm gonna try to solve npm package problems by making a new npm package!) Something that can allow you to delay most updates by a set amount of time, only allow installing or updating dependencies based on a personal whitelist of contributors or authors (requiring some manual review perhaps of diffs from code that isn't from your approved contributors list), and a few other things. It won't stop everything, and a determined attacker will still get things through, but it could at least make it a bit harder.