Pnpm has a new setting to stave off supply chain attacks