Pin your dependencies and only update them manually, or if you do it automatically, only after running tests. Also use a registry mirror.

Add a layer of indirection between you and the source of your dependancies so you can control them?

Just a proxy that delays new version availability for a week would protect you from this.

But yarn add directly from the account of a madman who made your dependency is so much easier.

Control your dependencies, don't make them control you.

Pin dependendency versions, don't allow auto-upgrade. And cache your dependencies locally for as long as you depend on them.

Ideally

> What were they supposed to learn? "Don't have dependencies"?

Yes.

Or vet them thoroughly.