Socket: pnpm 11.5 Fixes False Trust-Downgrade Alerts for npm Staged Publishes

What it is

A pnpm 11.5 fix for a false positive in its trustPolicy: no-downgrade supply-chain check. When a package used npm's staged publishing (a 2FA approval step before a version becomes installable), the no-downgrade policy could wrongly flag the release as a trust downgrade from trusted publishing to classic token/account publishing. Reported by Kevin Deng, following npm tightening controls after the Mini Shai-Hulud stolen-token campaign.

How it works

The no-downgrade policy warns when a package appears to move from a stronger publishing mechanism to a weaker one. pnpm inferred whether a version used trusted publishing by inspecting the _npmUser field. But with staged publishing, _npmUser may point to the maintainer who approved the staged publish rather than reflecting the underlying flow — so a version published through trusted publishing but approved via staging looked like a fallback to classic user/token publishing. pnpm 11.5 instead reads the metadata approver field as its own trust signal, ranking it above trusted publishing and provenance attestations, so an approved staged release is treated as the strongest evidence rather than a downgrade.

Preconditions / Affected

Matters if you run pnpm with trustPolicy: no-downgrade and install packages that use npm's staged publishing (which can also be combined with trusted publishing — CI pushes to staging, a human approves via 2FA). Under pre-11.5 pnpm these produced noisy false downgrade alerts.

What to do

Upgrade to pnpm 11.5. No configuration change is described — the fix is in how metadata is interpreted. The release also includes other supply-chain-adjacent fixes worth noting if any apply:

• improved minimumReleaseAgeExclude handling, so excluded packages aren't pinned to stale versions in npm resolution fast paths
• preservation of the integrity field for remote HTTPS tarball dependencies when unrelated packages are installed afterward
• browser-based 2FA handling for pnpm dist-tag add and pnpm dist-tag rm against npmjs.org

Caveats

The fix only stops misclassification (fewer noisy alerts); it does not add new detection. The underlying problem is that tools must infer publishing security from fields like _npmUser — Deng has asked npm to expose explicit metadata stating how a version was published (trusted vs. staged). Until npm does, package managers remain exposed to both missed warnings and false positives as npm adds more publishing modes.