I mean, modern package managers generally now come with lock files, which effectively auto-pin your dependencies, until you trigger a dependency update.
And while it isn't bullet-proof, it does result in you effectively having a dependency cooldown most of the time. You're only vulnerable, if you trigger the dependency update while the compromised dependency release is public.
Obviously, this can be bad enough, but it does also mean that an ecosystem with lock files is far less attractive to target with a supply-chain attack, since far fewer hosts will get compromised on average.
Man, I keep having that problem, that some car or motorcycle sounds like it needs a repair to me, only for me to realize that, no-no, they want it to sound like that.
Just yesterday evening, I heard someone revving before accelerating again after a stop at a crossing, and if they would've gotten out of their car at that point, I might've shouted over that, damn, sounds like they need to get their clutch looked at.Genuinely thought they failed to engage a gear multiple times. Meanwhile, they would've probably punched my face in, if I insulted their car like that. 🙃