Most of these point come down to: don't trust random shit from the internet and don't blindly pull it into your projects/env.
Enable JavaScript and cookies to continue
"By now, you may have guessed that I didn't have literally backdoored your dependencies, but someone else may have, or will."
Broken link
So what do we do? I really think something like Firejail must be the way to go, but it's absolutely not ready for user-friendly prime time. And what do you do on macOS, or for every little tool like `ls` (where I want say filesystem access but not network).
It all seems a bit hopeless, I refuse to believe anyone who claims to audit everything and every update - and would they have caught xz's backdoor anyway?