Pnpm has a new setting to stave off supply chain attacks | Not Hacker News!