🧰 pnpm

The items that name it 32

• Software supply chain security best practices for 2026
  articleas affected products2026-10-21
• vlt 1.5.0 Adds Agent Skills Management
  articleas classification.technologies2026-10-21
• Package managers have an integrity problem
  writeupas classification.technologies2026-10-14
• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeupas classification.technologies2026-10-12
• upm Launches as a Fast, Tiny Package Manager Written in TypeScript
  articleas tools2026-09-29

  Package manager compared against upm for size and install speed (pnpm 12 used in benchmarks)

• Package Manager Sandboxing (Andrew Nesbitt)
  articleas classification.technologies2026-09-24
• Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)
  writeupas tools2026-09-24

  Alternative package manager used by the upgrade endpoint with the same injectable install command

• How to Defend Against NPM Software Supply Chain Attacks | Blog | Endor Labs
  articleas tools2026-09-11

  Package manager that disables lifecycle scripts by default (opt-in) and offers a minimum release age feature

• Why Cooldown Windows Belong in Every npm Security Strategy | Blog | Endor Labs
  articleas affected products2026-09-11

  package manager that has recently added ability to implement cooldown periods, unlike npm

• Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs
  writeupas tools2026-09-11

  Package manager; minimum release age setting can help delay adoption of new/malicious versions; disables lifecycle scripts by default

• PackageGuard
  repoas affected products2026-08-31

  Package ecosystem scanned by PackageGuard for dependencies, licenses and risk

• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeupas tools2026-08-28

  Package manager used by the compromised release workflow to install dependencies from the untrusted pull request before publishing

• S1N6H/pentest-harness
  repoas classification.technologies2026-08-27
• Control Which Package Registries Your CI Jobs and Developer Machines Use
  articleas affected products2026-08-12

  package manager that can be explicitly configured to use registry.npmjs.org

• Socket: Fake Corepack Site Distributes Infostealer and Proxyware to Developers
  writeupas affected products2026-07-25

  Package manager managed via Corepack

• Socket: pnpm 11.10 Hardens Registry Authentication to Block Token Redirection
  articleas tools2026-07-16

  Package manager for Node.js; version 11.10 adds supply chain security hardening including registry authentication protections

• Socket: npm v12 Ships With Install Scripts Off by Default
  articleas affected products2026-07-15

  Blocked lifecycle scripts by default

• What is a dependency firewall?
  articleas affected products2026-07-13

  package manager; supports minimum release age setting

• VeridionLabs/veridion
  repoas classification.technologies2026-07-07
• Socket: Introducing Manifest Alerts
  articleas affected products2026-06-18

  supported ecosystem for missing lockfile detection and remediation guidance

• Socket: pnpm 11.5 Fixes False Trust-Downgrade Alerts for npm Staged Publishes
  articleas tools2026-06-13

  Package manager; version 11.5 adds recognition of npm staged publish approvals as trust evidence and fixes false trust-downgrade alerts

• Socket: RubyGems Bundler 4.0.13 Adds Opt-In Cooldown for Newly Published Gems
  articleas tools2026-06-13

  package manager that introduced minimumReleaseAge setting to delay dependency updates

• The Pros and Cons of NPM v12's Security Improvements
  articleas affected products2026-06-10

  Shipped minimumReleaseAge cooldown setting in September 2025

• CVE Lite CLI
  repoas classification.technologies2026-05-31
• Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens
  writeupas tools2026-05-27

  Package manager used inside the Android app's PRoot sandbox to pull codexui-android@latest at runtime (unpinned version)

• Bumblebee
  repoas classification.technologies2026-05-24
• Socket: Mini Shai-Hulud
  articleas classification.technologies2026-05-22
• VSCode Lifecycle Script Malware
  writeupas tools2026-05-16

  Package manager that disables lifecycle scripts by default from v10+

• Agentic Workflows
  articleas classification.technologies2026-05-13
• Socket: pnpm 11 Adds Supply Chain Protection Defaults
  articleas tools2026-05-07

  JavaScript package manager; version 11 adds supply chain protection defaults (Minimum Release Age, Block Exotic Subdeps, Allow Builds), native publish/registry commands, built-in SBOM generation, audit fixes via lockfile updates, Store v11 with SQLite index, and isolated global installs.

• Cooldowns.dev
  articleas tools2026-05-06

  Node.js package manager; minimumReleaseAge cooldown (added 10.16.0), default 1440 minutes enabled in v11+.

• AikidoSec/safe-chain
  repoas classification.technologies

In every workspace you can read 40