As a javascript dev with a security mindset the npm package repository and similar ones are kind of scary since it's very hard if not impossible to inspect every package for every update etc.
As soon as you run any framework or basically any bigger library at all you're in the hands of hundreds if not thousands of other people. It's like something big is just around the corner to happen and it can be used to make massive damage. If I were a state actor for example, I would use npm and similar tools to be able to shut down sites and systems on a massive scale at will if a war would break out or similar.
The thing is that if you would not use any libraries and similar it would be much harder to compete against the people and companies that do use all the libraries.
So what can you do? I guess the main thing is to use a language that has a massive standard library which you don't need so many external packages. That way, every change is at least audited and perhaps it's possible to audit all the external packages you need yourself?