pnpm

“we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!”

“The disk usage and performance wins are life-changing for daily work and CI flows.”

“doesn't take up that much disk space for me with standard pnpm deduplication”

“pnpm is generally safer and had the age delay much sooner than npm as well.”

“pnpm, by contrast, allows you to essentially "opt-in" only specific packages that need this”

“pnpm can still be exposed, afterall the worm simply have to wait you run tests locally.”

“pnpm, by contrast, allows you to essentially opt-in only specific packages that need this”

“That's helpful to prevent individual secret harvesting, however it does not protect you from potential silent downstream effects in packages.”

“It has dependency cooldowns, build scripts disabled by default, and the setting you mentioned.”

“I am glad to have enabled these back in March before the last two waves hit.”

“none of which will run the malicious "prepare" hook in the first place unless specifically allowed.”

“pnpm reads .npmrc for some reason, despite not having the same options as npm”

“There is no way to bootstrap it without binary blobs making it an easy target supply chain attack”

“pnpm sets a high bar, so even if aube ends up getting faster, it's not a sure thing”

“Both yarn and pnpm support http/2 which speeds up the bazillion requests quite a bit.”

“for better speed, determinism, node_modules bloat reduction, dep graph mgmt, install script safety”

“Currently pnpm only supports setting this option via persistent config file, not per-run.”

“Pnpm makes things more secure without install scripts, mininum package time”

“Advising every user of npm/pnpm to change their settings and set their own cooldown periods is not a real choice.”

“JS package managers (pnpm, bun) now will ignore postinstall scripts by default.”

“PNPM makes you approve postinstall scripts instead of running them by default, which helps a lot.”

“Good news for pnpm/bun users who have to manually approve postinstall scripts.”

“the only benefit I find with pnpm is a little bit of speed when using the cli, but not enough that I notice”

“These mostly solve the issue of adding postinstall scripts and packages being compromised.”

“Saner node package managers like pnpm ignore the build script and you have to explicitly approve it on a case-by-case basis.”

“what pnpm brings on top of npm is way less than the difference between uv and the status quo”

“It stores packages in a global cache, and hardlinks to the local node_packages.”

“Every millisecond of time saved will be out the window the first time someone is stuck dealing with an edge case”

“I do understand this is still better than npm right now, but it's still broken.”

“With pnpm's dependency cooldown and whitelisting of postinstall scripts, you are probably good.”

“PNPM also lets you specify a minimum package age, so you cannot install packages younger than X.”

“PNPM - the packager used in this case - doesn't automatically run postinstall scripts.”

“pnpm does all that on top of node. Also disables postinstall scripts by default, making the recent security incidents we've seen a non-issue.”

“We also suggest you make use of the minimumReleaseAge setting present both in yarn and pnpm.”

“using pnpm or something similar that blocks postinstall scripts by default should be sufficient”

“I would maybe choose the tried and true PNPM instead, which supports this too.”

“minimumReleaseAge strikes a good balance between protecting yourself against emerging threats”

“Until you fix your processes and workflows, this will continue to happen, even if you use pnpm.”

“Pnpm (a very popular npm replacement) makes completely locked packages easy and natural and ultra fast”

“it by default prevents packages from taking any actions during installation”