Is there any sort of validation mechanism mitigating MITM supply chain attacks in the case an attacker breaches a repo server like NPM or PyPi?

We know of [all sorts](https://jfrog.com/blog/npm-package-hijacking-through-domain-takeover-how-bad-is-this-new-attack/) of [ways](https://www.scmagazine.com/news/third-party-risk/iconburst-supply-chain-attack-uses-typo-squatting-to-spread-malicious-javascript-packages-via-npm) supply chain attacks can happen against individual repositories.

I'm thinking of a more drastic scenario where an attacker breaches the server delivering the packages. I'm not at a desktop to cite the domains NPM packages are loaded from, or PyPi, etc, but you know the ones.

Don't packages actually get delivered from centralized servers delivering content for those package managers? If I recall correctly, when I was trying to load Pip packages in …

attacks breaches case cybersecurity mitm npm pypi repo server sort supply supply chain supply chain attacks validation