The latest version of all node package managers (npm, yarn, pnpm) now deny this by default. pnpm was ahead of the curve.