Software supply chain attacks follow a predictable pattern: compromise a maintainer account, push a malicious update, and wait for downstream projects to pull it. Recent March 2026 incidents (Trivy-action, Axios) illustrate the real-world impact. This guide covers practical defensive strategies across multiple layers: minimizing dependencies, adopting cooldowns (a 7-day delay would have prevented 90%+ of recent attacks), using lockfiles with hashes, restricting install-time script execution, and deploying wrapper tools. Organizational controls include remote developer environments, zero-trust production, registry pull-through proxies, and curated registries. For detection when prevention fails, honeytokens planted in CI environment variables provide high-signal alerting. The overarching philosophy is informed trade-offs rather than perfect security: raise attack cost, shrink exposure windows, and limit blast radius.
