Vet your dependencies, at least to the level of making sure your direct ones are actually real projects done by known people and reasonably widely used. Note th

Vet your dependencies, at least to the level of making sure your direct ones are actually real projects done by known people and reasonably widely used. Note that for all the buzz about these kinds of attacks, there's relatively little evidence they are actually successful at being downloaded and installed by anything but automated scanning/archiving systems.