Skip to content

Back to the catalog

Socket: pnpm 11 Adds Supply Chain Protection Defaults
socket.devarticle

Socket: pnpm 11 Adds Supply Chain Protection Defaults

Socket covers pnpm 11's new security-by-default settings: a 24-hour Minimum Release Age that delays resolution of freshly published package versions, blockExoticSubdeps which by default rejects transitive dependencies resolved from git/tarball URLs instead of the registry, and a new allowBuilds model that consolidates prior build-script controls (onlyBuiltDependencies, ignoreDepScripts, etc.) into a single package-pattern-to-boolean map. The piece ties these defaults to the conditions exploited by the Mini Shai-Hulud campaign (npm/PyPI/Packagist compromise using preinstall hooks to fetch a Bun runtime and run a credential stealer), and also notes pnpm 11's built-in SBOM generation (CycloneDX 1.7/SPDX 2.3), GHSA-based audit --fix=update, and a preview of the Rust-based Pacquet install engine slated for pnpm v12.

TL;DR pnpm 11 now defaults to a 24-hour minimum release age, blocks exotic (non-registry) subdependencies, and adds an allowBuilds model to curb install-time supply-chain attacks like Mini Shai-Hulud.
Open original ↗
Document

What it is

pnpm 11, the release that flips several supply-chain controls on by default. The summary names the three defaults; the page gives the exact setting names, values, and the migration constraints an engineer needs before adopting it.

How it works

Three defaults change:

  • Minimum Release Age now defaults to 1440 minutes — newly published versions are not resolved until they are 24 hours old, blunting the fast-publish/fast-install window attackers rely on.
  • Block Exotic Subdeps (blockExoticSubdeps: true) stops transitive deps from resolving via git repos or direct tarball URLs instead of the registry.
  • allowBuilds replaces five older, split settings with a single map from package-name patterns to booleans, governing which packages may run build scripts at install.

Preconditions / Affected

  • Node.js 22 is required. pnpm 11 drops support for Node 18, 19, 20, and 21, and pnpm itself is now pure ESM — the hard blocker for upgrading.
  • Teams relying on git/tarball subdeps, or on fresh releases resolving immediately (e.g. tight release-then-consume loops), will see behavior change under the new defaults.

What to do

  • To opt out of the release-age delay: set minimumReleaseAge: 0.
  • Migrate build-script config to allowBuilds. It replaces onlyBuiltDependencies, onlyBuiltDependenciesFile, neverBuiltDependencies, ignoredBuiltDependencies, and ignoreDepScripts — audit any of these you currently set.
  • Other useful additions worth checking: pnpm sbom generates CycloneDX 1.7 or SPDX 2.3 JSON; pnpm audit --fix=update fixes vulns via lockfile updates rather than overrides, and audit now uses GHSA-based (not CVE-based) filtering; publish/registry commands (publish, login, view, deprecate, unpublish, dist-tag, version) no longer delegate to the npm CLI.

Caveats

The page is explicit that pnpm 11 "would not have prevented every part of" the Mini Shai-Hulud campaign. Blocking exotic subdeps is "not a direct fix for every registry-published compromise," and allowBuilds "does not remove the need for dependency review." These are friction against fast-moving chains, not guarantees. Pacquet, the Rust install engine, is slated for v12, not present here.

Technologies named here

Techniques named here

Threat actors named here

Related in Supply Chain