The latest version of all node package managers (npm, yarn, pnpm) now deny this by default. pnpm was ahead of the curve.

npm v12 released last month also defaults into blocking them by default