Another effective strategy I learned of recently that seems like it would have avoided this is to wait months before using new versions of packages.

Most attacks on popular packages last at most a few months before detection.