Copy/pasting source code doesn't solve either of those problems either.
If you already had left pad cached then you were not affected by its disappearance.
If a package needs an install script to be used, to compile some native code for example, you still need to run the install script before you can use the package.
Manually repeating the actions npm does automatically does nothing to protect you from supply chain attacks.
The only thing that helps is to review code before you run it. How the code got to your machine before it was run does not matter.
If you already had left pad cached then you were not affected by its disappearance.
If a package needs an install script to be used, to compile some native code for example, you still need to run the install script before you can use the package.
Manually repeating the actions npm does automatically does nothing to protect you from supply chain attacks.
The only thing that helps is to review code before you run it. How the code got to your machine before it was run does not matter.