Codeberg only serves a small subset of what Github does.
Pitching them as a no-brain replacement and advising people to move all their personal repos over is abusive towards Codeberg.
For community-facing FLOSS it is good. For other uses you need to look elsewhere. Forgejo, which is what Codeberg ises, is easy to self-host and other providers exist.
If supply-chain security is a concern yarn is the worst js package manager you can pick. It comes far down their priority list, below "just make things work without need for user input". Whatever you thought you configured will simply be ignored many times and that's considered a feature.
Go look in that projects issue tracker and commit log for changes to relevant configuration and you will know what I mean.