It seems that to counter this type of supply chain attack, the best practices for managing software dependencies are to pin the version numbers of dependencies

It seems that to counter this type of supply chain attack, the best practices for managing software dependencies are to pin the version numbers of dependencies instead of using `latest`, and to use static linking instead of dynamic linking.