Can't agree more. I'm working on OSS security tool that can protect you from Shai-hulud, no half measures.

The idea is to have a local proxy that injects real secrets into requests in-flight, so a compromised library has nothing to steal because it never had access to any of your secrets: https://github.com/inflightsec/agent-vault-proxy