The only way to completely prevent to get malicious code in your products is writing all code by yourself including the interpreter/compiler and maybe the opera

The only way to completely prevent to get malicious code in your products is writing all code by yourself including the interpreter/compiler and maybe the operating system too. Machines should be off the Internet of course and security should be there 24/7. And of course you need to have a very high bar and a paranoid process to select the people you hire. But now you will move at the pace of a bacteria on a snail. But since the company will probably introduce vulnerability bugs in the code they write, it is probably not a very good idea. We are using open source and free packages to save time and move fast. Security and speed/usability have tradeoffs. The paranoid will do everything in their knowledge to protect themselves but they will move slowly. The naive will not do anything and sooner than later will get burnt. Assuming you trust your current modules and you can trust that they will not be altered, you can lock down the dependencies. But now monitor and updating a library when a bug or vulnerability is found in a modules become another burden. Those actors that have the budget, patience and the motivation will always find a way in. I sometimes feel quite sad about the real situation but there is not such a thing as perfect security. That said some of the suggestions I see here will dramatically improve the situation with a relatively small effort. 2FA and reproducible builds for example.