You can make things a bit better immediately by installing on outbound firewall like Little Snitch or Open Snitch.

And then if you install a malicious package that phones home, you might get an alert.

Of course this doesn't guarantee anything, as the package might activate the malicious behavior only under some specific circumstances. But it also doesn't cost anything. So it's a small win in my book.

Here's how it works in practice:

https://askubuntu.com/questions/1145649/apt-strange-requests...

--note this part in the accepted answer:

> they are surprised that more people hadn't noticed the behavior in the past.

There is another ongoing thread in HN here: https://news.ycombinator.com/item?id=38641211 with extra feedback.

I mean, I use NPM, but I'm making a small traffic news site with no APT enemies. If you're making a wallet and think "Yes, auto-updating dependencies sounds like a good idea," maybe you're not very good at security?