Is there an easy tool maybe something for ${bundler} to take your package.json and rewrite everything to refer to static versions hosted on your own cdn?
At least that way upgrades, malicious or otherwise are opt in for production
The other thing would be ideally a crowd funded resource to vet particular versions of popular packages.
For NPM use https://verdaccio.org/ . It can proxy the public registry. Install your project and it will pull and cache the dependencies. Once cached you can remove the uplink and it will only serve the cached version
At least that way upgrades, malicious or otherwise are opt in for production
The other thing would be ideally a crowd funded resource to vet particular versions of popular packages.