Comment by philipwhiuk

pnpm and bun have approved lists.

npm is just dragging it's feet - and stuff like this is why people moved to pnpm, yarn and bun in the first place.