I think a big step forward is for folks to pin versions of things. NPM and pip and many other systems let software depend on a semantic versioning of their dependencies which makes it impossible to know what will be installed. If you at least know what is going to be installed and the URL is known then you can rely on a third party notary to tell you the expected contents...
Which is what we are building with Asset Transparency to provide a public transparency log backed database of URL content digests.
https://www.transparencylog.com
We have started to build tools for integrating into release pipelines too:
https://www.transparencylog.com/software-release-process-int...
I think it would be great to see package management systems use things like this. Go already does.
If anyone wants to get started quickly checkout our CLI tool: