The practical checklist for defending against supply chain attacks

TL;DR: Aikido's post presents a prioritized 30‑item checklist to defend engineering teams against modern software supply‑chain attacks, motivated by recent compromises (axios, chalk, debug, tj-actions, Bitwarden CLI, Zapier/PostHog). It covers concrete controls — package age policies, lockfile and SHA pinning, scoped tokens and phishing‑resistant MFA, CI/CD and container hardening, developer machine lockdown, MCP/agent permissions, prompt‑injection defenses, and audit logging — so teams can prioritize critical fixes to reduce risk before the next malicious release.