Ever since he got popped by the npm Shai Halud worm, I confess that I get extremely nervous doing anything in the repo where he does all his JavaScript work. Like "what styling package is gonna cause me to have to rotate all of my keys and passwords?" with every pnpm command.