A critical dependency is replaced with a malicious package of a similar name. What defense best addresses this supply-chain risk?

1. Rely only on transport encryption to the package server
2. Verify dependency provenance and enforce approved package controls
3. Trust any package with a high download count
4. Allow unrestricted dependency changes in production