The recent npm supply chain attacks relied on lifecycle scripts, which Deno doesn't run by default, but neither do pnpm or Bun. While Deno, like npm, supports a minimum release age, it doesn't enable it by default.
even with blocking lifecycle scripts, the attacker could have planted it somewhere else or just trick the dev somehow to run it