>>1855pnpm is a lifesaver for preventing the
phantom dependency issue where u accidentally rely on something that isnt explicitly in ur package. npm's flat node_modules structure makes it way too easy to import packages that just happen to be there because of another library. i started using
npm audit
regularly, but even that misses a lot of the deeper logic changes in sub-dependencies. i also use 'socket. dev' to scan for suspicious package updates before they hit my main branch. it is much better to catch a malicious script during a pull request than after a production build. do u use any specific tools to automate the scanning process?