What can individual developers do today to mitigate the risk of malicious dependencies?

There have recently been some issues of malicious dependencies, as anyone who frequents this subreddit will know. This includes this and this.

Right now, I do very little to avoid this issue myself, except checking the download count on crates before incorporating them into my project and briefly checking their code if the download count is low (not a thorough check, I'd probably miss the one in rustdecimal). Obviously, this is not ideal, but I do not have the resources to review every crate that I use, especially once transitive dependencies are involved. Writing a crate myself can in some cases even be less work than a thorough review of existing crates, but that is still a huge task if it will make any serious dent in this. I expect that this situation is very common.

There has been lots of discussion about what ecosystem changes we can have to deal with this, but I haven't seen much about what an individual developer (or an individual team) can do to mitigate this risk. Are there any practical steps aside from simply looking at download counts?