Fast, disk space efficient package manager Sponsor us: GH: github.com/sponsors/pnpm OC: opencollective.com/pnpm We don't endorse any memecoins!
- Tweets 1,462
- Following 7
- Followers 27,210
- Likes 477
blockExoticSubdeps will be actually true by default in v11
The axios breach is a good opportunity to review your package manager settings
I recommend pnpm @pnpmjs
Default: postinstall scripts are blocked, protects against axios vector
Also try:
- minimumReleaseAge: 10080 (pkgs must be min 7 days old)
- trustPolicy
- blockExoticSubdeps
3
19
179
53,467
pnpm blocks all scripts from dependencies by default. You can read about this and other ways to protect yourself (like setting minimumReleaseAge) on our website: pnpm.io/supply-chain-securit…
3
17
114
6,973
A popular npm package has been attacked
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
3
5
121
14,240
Now that pn will be the official short alias for pnpm CLI, it kinda makes sense to have "pn pm clean" as a way to force a builtin command😁
This was raised in our repository yesterday and "pnpm clean" will run the local script, when present. "pnpm deploy" and "pnpm setup" too. So, nothing to worry about
2
1
88
10,545
This was raised in our repository yesterday and "pnpm clean" will run the local script, when present. "pnpm deploy" and "pnpm setup" too. So, nothing to worry about
FYI pnpm will ship a built-in command named “pnpm clean” in the next major. If you have an npm script named clean, you will have to use “pnpm run clean” instead.
This is why we don’t ship implicit script fallback in Vite+.
9
9
418
77,252
pnpm retweeted
I've been travelling alot recently in countries with poor 4G/5G cellular, or in Planes with no WiFi.
I can still remember how to code by hand, but offline NPM package discovery was a real blocker.
Lot's of Package Managers support offline install, but the packages themselves were hard to discover.
So I built an npmjs.com style experience that's backed entirely by the @pnpmjs cache.
- Copies the entire `pnpm` cache to an SQLite DB with version number, dependency graph, and Readme.md (with incremental update)
- Full text search via FTS5 extension
- Readme rendering with `marked` and @vercel_dev Sugar High syntax highlighting
Et Voila, offline NPM Registry where I can search for keywords to find packages I may want to use.
5
17
3,081
pnpm v11 Beta 0 is out! If you want to test it, you can install it with "pnpm self-update next-11"
github.com/pnpm/pnpm/release…
10
100
6,075
pnpm + Git Worktrees for Multi-Agent Development
pnpm.io/11.x/git-worktrees
7
38
450
63,733
pnpm retweeted
Monorepo+Git Worktrees+pnpm Global Virtual Store is the perfect dev stack for multi-agent development.
about the pnpm global virtual store: pnpm.io/settings#enablegloba…
in pnpm v11 it will work more reliably but I think in v10 it is also good
1
6
66
7,385