Supply-chain attacks are big problem for the JavaScript ecosystem. In this short post I will outline a straightforward security measure that can be implemented by all JavaScript runtimes, both in-browser and off-browser. This will prevent most of the supply-chain attacks that are plaguing the JavaScript ecosystem today.