Dependency Confusion Attack – What, Why, and How? (redhuntlabs.com)

It's kind of crazy that "vendor your dependencies, and review changes to them as with other code" is not even mentioned in the "Conclusion & Recommendations" section.