You can have a security solution but with large ecosystems like this it can’t be pushed to the ecosystem immediately and everyone will take longer to test and deploy.

Right now you could audit packages and make sure you don’t get the latest version