Chainguard based images, packages and libraries are first line of defense. Expensive? Yes. Foolproof? No. I think these types services will be mandatory in the near future.
Though I would expect that Insights uses RPM packages to ship components and not the public NPM packages.