#pnpm

One line of config that blocks most npm supply-chain attacks

Malicious package versions are usually caught within days. pnpm's minimumReleaseAge makes you structurally immune to the window where they do damage.