Comment by sync

That’s weird, pnpm no longer automatically runs lifecycle scripts like preinstall [1], so unless they were running a very old version of pnpm, shouldn’t they have been protected from Shai-Hulud?

1: https://github.com/pnpm/pnpm/pull/8897