I always pin dependencies to fixed versions in production software, which makes it less likely that my toolchain gets poisoned by a rogue version update. Also,

I always pin dependencies to fixed versions in production software, which makes it less likely that my toolchain gets poisoned by a rogue version update. Also, for languages that allow it I bundle dependencies locally (in Python e.g. using Wheels) or run my own registry proxy, which makes poisoning by registry takeover also less likely. Personally I think there are bigger threats than malicious dependencies, especially if an adversary specifically targets me. My biggest concern is what happens when someone takes over our CI/CD setup, as that gives way more access to an adversary.