Ask HN: What to do to protect against NPM malicious activities?

Hi, yesterday's episode showed us how risky using NPM is. What would be a strong and practical alternative? Is it to save the node_modules and use that instead of downloading the packages while building? Thanks