# pnpm 124 Hacker News commenters recommended pnpm and 24 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months; owners who said how long report a median of 5 years (4 owners). It meets the Hacker Approved badge rule. **Verdict:** A faster, disk-efficient npm replacement whose blocked-by-default install scripts and release-age cooldowns help against supply chain attacks, though critics note it doesn't fully stop them. ## Why people recommend it - Blocks install scripts by default (15 comments): "pnpm does all that on top of node. Also disables postinstall scripts by default, making the recent security incidents we've seen a non-issue." ([source](https://news.ycombinator.com/item?id=46124947)) "Saner node package managers like pnpm ignore the build script and you have to explicitly approve it on a case-by-case basis." ([source](https://news.ycombinator.com/item?id=47256894)) "none of which will run the malicious "prepare" hook in the first place unless specifically allowed." ([source](https://news.ycombinator.com/item?id=48101961)) - Minimum release age cooldown (9 comments): "PNPM also lets you specify a minimum package age, so you cannot install packages younger than X." ([source](https://news.ycombinator.com/item?id=46278331)) "With pnpm's dependency cooldown and whitelisting of postinstall scripts, you are probably good." ([source](https://news.ycombinator.com/item?id=46360366)) "It has dependency cooldowns, build scripts disabled by default, and the setting you mentioned." ([source](https://news.ycombinator.com/item?id=48112393)) - Fast installs (6 comments): "we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!" ([source](https://news.ycombinator.com/item?id=50027744)) "Pnpm (a very popular npm replacement) makes completely locked packages easy and natural and ultra fast" ([source](https://news.ycombinator.com/item?id=46033898)) "for better speed, determinism, node_modules bloat reduction, dep graph mgmt, install script safety" ([source](https://news.ycombinator.com/item?id=47874476)) - Saves disk space via hardlinks (4 comments): "for better speed, determinism, node_modules bloat reduction, dep graph mgmt, install script safety" ([source](https://news.ycombinator.com/item?id=47874476)) "The disk usage and performance wins are life-changing for daily work and CI flows." ([source](https://news.ycombinator.com/item?id=50022851)) "It stores packages in a global cache, and hardlinks to the local node_packages." ([source](https://news.ycombinator.com/item?id=47089906)) ## What people warn about - Not full supply chain protection (5 comments): "That's helpful to prevent individual secret harvesting, however it does not protect you from potential silent downstream effects in packages." ([source](https://news.ycombinator.com/item?id=48198165)) "There is no way to bootstrap it without binary blobs making it an easy target supply chain attack" ([source](https://news.ycombinator.com/item?id=48013257)) "Until you fix your processes and workflows, this will continue to happen, even if you use pnpm." ([source](https://news.ycombinator.com/item?id=46036721)) - Bugs and hard-to-debug edge cases (4 comments): "Every millisecond of time saved will be out the window the first time someone is stuck dealing with an edge case" ([source](https://news.ycombinator.com/item?id=47061595)) - Awkward configuration (4 comments): "Advising every user of npm/pnpm to change their settings and set their own cooldown periods is not a real choice." ([source](https://news.ycombinator.com/item?id=47584621)) "Currently pnpm only supports setting this option via persistent config file, not per-run." ([source](https://news.ycombinator.com/item?id=47681583)) "pnpm reads .npmrc for some reason, despite not having the same options as npm" ([source](https://news.ycombinator.com/item?id=48101320)) - Modest gains over npm (2 comments): "the only benefit I find with pnpm is a little bit of speed when using the cli, but not enough that I notice" ([source](https://news.ycombinator.com/item?id=47415680)) "what pnpm brings on top of npm is way less than the difference between uv and the status quo" ([source](https://news.ycombinator.com/item?id=47120635)) ## Alternatives hackers recommend - [Nix](https://hackerapproved.com/p/nix.md): 378 recommend - [Homebrew](https://hackerapproved.com/p/homebrew.md): 271 recommend - [npm](https://hackerapproved.com/p/npm.md): 161 recommend - [Cargo](https://hackerapproved.com/p/cargo.md): 123 recommend - [GNU Guix](https://hackerapproved.com/p/gnu-guix.md): 84 recommend ## Cite as Hacker Approved, "pnpm", https://hackerapproved.com/p/pnpm/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).