The best answer I can provide is to nuke your entire software supply chain from orbit and start over with something new that doesn't require you to depend on potentially hundreds of arbitrary 3rd parties. Factor into this all of your tooling and infrastructure vendors as well.
You might not like our particular brand of medicine, but we are finding massive success in these supply chain matters with a pure Microsoft stack: .NET core/5/6, GitHub, Azure, VS2022, Server 2019, et. al. We also technically use SQLite, but no one has ever attempted to probe us on that vendor, and it is incorporated well enough into the Microsoft death star (Microsoft.Data.Sqlite) to pass as yet another defensive armament at this point. We avoided shitty javascript web stacks by using technologies like Blazor, or just hand-rolling a little vanilla javascript when required (the horror, i know).
The reason we like this path is that we now require virtually zero additional third party dependencies for building our B2B products. .NET6 covers nearly 100% of the functions we require. On top of this we have 1-2 convenience nugets like Dapper (StackOverflow, et. al.), but everything else is System.* or Microsoft.*. The only other 3rd party items we consume into the codebase come from vendors of our customers as part of our integration stack - typically in the form of WCF contracts or other codegen items. Now, we do hedge for the inevitable Microsoft framework churn by not getting too deep into certain pools like AspNetCore. For example, we have rolled all of our own authentication, logging & tracing middleware, since this is the area they seem most hellbent on changing over time.
Certainly, Microsoft has, can, and will drop the ball, but they also have a very long track record available to build [dis]trust upon. For us, we went with the trust path. If our customers run us through the due diligence gauntlet (and they will - we're in the banking industry), we can produce a snarky ~1 item list of vendors that makes life much easier for everyone involved. No one has ever given us a hard time for doing business with Microsoft. Typically, everyone we work with is also to some degree. Is this bad? Maybe. I am ambivalent about the whole thing because of how much energy they have apparently put into the open source side of things. I have actually been able to contribute to their process on GitHub and watch it come out the other side into a final release I could use to correct a problem we were having.