Comment by mkesper Comment by mkesper 5 days ago 0 replies Copy Link View on Hacker News At least make them run pnpm instead of npm, disabling post-install scripts. https://pnpm.io/supply-chain-security