Protect the package lifecycle from malicious or vulnerable dependencies, typosquatting, secret leaks, and unsafe build scripts. Use lockfiles, audits, signing, provenance, SBOMs, and dependency update workflows.
