Hopefully, the client I work for wasn't affected by #Sha1Hulud2. The collective decision on that project was to use as few JS as possible and not use NodeJS at all.
AFAIK, this is the third time I've seen the #JS ecosystem get pwned and I don't know if it's because it's popularity makes it a target of choice or if it has always been broken.
Also, I can't find any info as whether pre-commit may be an attack vector. After some hook install a #NodeJS environment.