[chevman]

Many (most?) software supply chain attacks that I have observed in the wild over the last 10 years started with compromised user level credentials, or bad actors with (at the time) legit access.

My current thinking is there are too many ways in to protect yourself with 100% security, so better to spend time figuring out how to reduce the blast radius, and what your recovery protocol will be when you get hit.

[struant]

You can also reduce your attack surface (dependencies).