Get the latest tech news
Pnpm has a new setting to stave off supply chain attacks
Minor Changes
In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour. For example, setting minimumReleaseAge: 1440 ensures that only packages released at least one day ago can be installed. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:
Or read this on Hacker News
