Well you can't, slowing down is a must. Blindly taking packages of executable code to be embedded in your code from anyone and everyone in the world who can publish a dependency is very flawed. It only mostly works because most people are nice most of the time but that's not a process one can trust.

I understand the desire for these free-for-all package distributions where every tool has it's own library downloader and anyone can publish anything... but the model is inherently incompatible with security.

On the provider side, there needs to be a strict process of validation and code reviews to get any code changes into a public library. On the consumer side, there needs to be the will to take personal responsibility to curate everything that is imported and minimize dependencies.

There's no shortcut to secure code.