Well pnpm does it by default for quite some time. It’s annoying, yes, but I take a little annoyance if it means I’m more secure.