Post

I forked Bun's internal allowlist for those who need the protection from this new default but don't want to bother reviewing every dependency one-by-one: github.com/haoqunjiang/...

github.comGitHub - haoqunjiang/build-scripts-allowlist: An up-to-date list of common NPM packages that need to run lifecycle scripts during installation.An up-to-date list of common NPM packages that need to run lifecycle scripts during installation. - haoqunjiang/build-scripts-allowlist

Socket@socket.dev

Big changes in @pnpm.io 10.0.0: Lifecycle scripts are now blocked by default to combat supply chain attacks. This change is widely supported but comes with some friction. socket.dev/blog/pnpm-10... #NodeJS #pnpm #JavaScript

socket.devpnpm 10.0.0 Blocks Lifecycle Scripts by Default - Socketpnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workf...

16/1/25, 7:40 am1 repost5 likes

I made one with info whether scripts are necessary a while back npmjs.com/package/can-... Maybe some of it is useful to you

npmjs.comcan-i-ignore-scriptsA service and cli to analyze your dependencies and check what'll break when you switch from `npm ci` to `npm ci --ignore-scripts`. Latest version: 0.1.9, last published: 2 years ago. Start using can-i...

Yes, very helpful! It's major inspiration for me to start this list, as well as LavaMoat, and I have put links to both of them in the README.

I was looking for some motivation to do a 2.0 of that package this spring. Remove the data collection and put some more research in. Wanna join me?

Sure, that sounds interesting! What features do you have in mind?