pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently, for many reasons. Fortunately npm v12+ disables lifecycle scripts by default.