Published package.json includes "prepare": "husky" since 2.11.0 (Socket supply-chain score 99 -> 45) #159

Since 2.11.0 the published package.json contains "scripts.prepare": "husky" (2.9.2 did not).

Socket.dev's supply-chain score for the package dropped from 0.99 (2.9.2) to 0.45 (2.11.0, 2.11.1) with nothing else changing: its alert list is empty, and all four runtime deps (culori, fflate, node-html-better-parser, tslib) score 1.0. Tools that gate on Socket's score, such as react-doctor's supply-chain check, now fail for every project depending on @cantoo/pdf-lib.

npm does not run prepare on registry installs, so this is not exploitable. It is a dev-only husky hook that ended up in the tarball, and scanners see it as an install-time lifecycle script.

Suggested fix (PR incoming): strip it from the published copy only, in publish.yml before npm publish, with npm pkg delete scripts.prepare. Husky keeps working for contributors.