These are 2 recent options of pnpm that can help against certain classes of supply chain compromise.

https://pnpm.io/supply-chain-security

Additionaly, dependency updates are now delayed by 12 hours. It can potentially allow the community to detect compromise and pull the packages from the registry. The 12 hours mark should be reasonable with our response time to remediate security advisories and it puts us roughly in the time range it tooks to detect recent large scale supply chain attacks.