Post

PSA: Use @pnpm.io minimumReleaseAge. A simple way to make NPM supply chain attacks, like the one affecting the `axios` NPM package, more unlikely. maier.tech/notes/pnpm-m...

maier.techPNPM minimumReleaseAgeLearn how PNPM's minimumReleaseAge setting helps protect your project from compromised packages and improves supply chain security.

7/4/26, 1:16 pm9 reposts43 likes

naugtur

@naugtur.pl

7 Apr

And very carefully choose which lifecycle scripts to allow. And use www.npmjs.com/package/@lav... with other pkgmgrs. Next major will have version pinning that's also useful on pnpm. Check out experiments here too github.com/lavamoat/kip...

npmjs.comnpmjs.com

Jølly_Good

@jolly-good.bsky.social

7 Apr

I hope its age verification for npm package authors 🤣😂

Nate Spilman

@natespilman.at

7 Apr

I just learned about this on @syntax.fm ! Great feature