Best way to protect a project from supply chain attacks?

Dear Rust community,

in my current job we develop a fairly security-sensitive project built with Rust. Recently we were wondering how we could protect ourselves from supply chain attacks in our dependency tree (somewhat like the infamous NPM cases e.g. https://www.theregister.com/2022/01/10/npm\_fakerjs\_colorsjs/).

I guess one option for example would be to \cargo vendor\\ all dependencies and then manually review each update of the vendor directory. However, our current vendored deps are 500mb in size, and we'd really rather not include that in our monorepo.

Are there any other approaches people have thought of / been using?

One of our teammates suggested running our own internal crates server, is that practical?

Another mentioned https://github.com/crev-dev/cargo-crev but it seems like coverage isn't perfect and some versions of libraries covered by it are somewhat old.

Appreciate any pointers in this topic!