Linked-Out: Security Principles to Break Software Supply Chain Attacks