#pnpm — Public Fediverse posts

📦 Package coverage is broad: npm (#pnpm, #yarn, #bun), #PyPI, #Go modules, #RubyGems, #Composer. Reads lockfiles & install metadata — no package-manager execution, no source-file reads. Zero network calls during scans.

🔌 Also scans #MCP server configs (claude_desktop_config.json, mcp.json, Gemini CLI settings) and editor extensions for VS Code, Cursor, Windsurf, VSCodium — plus Chromium & Firefox browser extensions.

📦 Package coverage is broad: npm (#pnpm, #yarn, #bun), #PyPI, #Go modules, #RubyGems, #Composer. Reads lockfiles & install metadata — no package-manager execution, no source-file reads. Zero network calls during scans.

🔌 Also scans #MCP server configs (claude_desktop_config.json, mcp.json, Gemini CLI settings) and editor extensions for VS Code, Cursor, Windsurf, VSCodium — plus Chromium & Firefox browser extensions.

📦 Package coverage is broad: npm (#pnpm, #yarn, #bun), #PyPI, #Go modules, #RubyGems, #Composer. Reads lockfiles & install metadata — no package-manager execution, no source-file reads. Zero network calls during scans.

🔌 Also scans #MCP server configs (claude_desktop_config.json, mcp.json, Gemini CLI settings) and editor extensions for VS Code, Cursor, Windsurf, VSCodium — plus Chromium & Firefox browser extensions.

📦 Package coverage is broad: npm (#pnpm, #yarn, #bun), #PyPI, #Go modules, #RubyGems, #Composer. Reads lockfiles & install metadata — no package-manager execution, no source-file reads. Zero network calls during scans.

🔌 Also scans #MCP server configs (claude_desktop_config.json, mcp.json, Gemini CLI settings) and editor extensions for VS Code, Cursor, Windsurf, VSCodium — plus Chromium & Firefox browser extensions.

📦 Package coverage is broad: npm (#pnpm, #yarn, #bun), #PyPI, #Go modules, #RubyGems, #Composer. Reads lockfiles & install metadata — no package-manager execution, no source-file reads. Zero network calls during scans.

🔌 Also scans #MCP server configs (claude_desktop_config.json, mcp.json, Gemini CLI settings) and editor extensions for VS Code, Cursor, Windsurf, VSCodium — plus Chromium & Firefox browser extensions.

I never quite thought that the meme would be realised in the form of alternative package managers to npm, all of them rewriting to rust. CRAZY haha

#npm #yarn #pnpm #bun #rustlang

I never quite thought that the meme would be realised in the form of alternative package managers to npm, all of them rewriting to rust. CRAZY haha

#npm #yarn #pnpm #bun #rustlang

I never quite thought that the meme would be realised in the form of alternative package managers to npm, all of them rewriting to rust. CRAZY haha

#npm #yarn #pnpm #bun #rustlang

I never quite thought that the meme would be realised in the form of alternative package managers to npm, all of them rewriting to rust. CRAZY haha

#npm #yarn #pnpm #bun #rustlang

I never quite thought that the meme would be realised in the form of alternative package managers to npm, all of them rewriting to rust. CRAZY haha

#npm #yarn #pnpm #bun #rustlang

whenever there’s another #npm #supplychain attack, it’s time to start victim-blaming. unironically. don’t use npm, use #pnpm (or #bun).

pnpm stores your packages in a single central repository instead of downloading them all every time, and it also doesn’t run build scripts by default unless you ask it to. plus, it’s faster, but that’s less important.

if you use plain npm, you’re not a victim, you’re a perpetrator.

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @parcel/[email protected], [email protected], [email protected], [email protected]

Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.

whenever there’s another #npm #supplychain attack, it’s time to start victim-blaming. unironically. don’t use npm, use #pnpm (or #bun).

pnpm stores your packages in a single central repository instead of downloading them all every time, and it also doesn’t run build scripts by default unless you ask it to. plus, it’s faster, but that’s less important.

if you use plain npm, you’re not a victim, you’re a perpetrator.

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @parcel/[email protected], [email protected], [email protected], [email protected]

Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.

whenever there’s another #npm #supplychain attack, it’s time to start victim-blaming. unironically. don’t use npm, use #pnpm (or #bun).

pnpm stores your packages in a single central repository instead of downloading them all every time, and it also doesn’t run build scripts by default unless you ask it to. plus, it’s faster, but that’s less important.

if you use plain npm, you’re not a victim, you’re a perpetrator.

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @parcel/[email protected], [email protected], [email protected], [email protected]

Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.

whenever there’s another #npm #supplychain attack, it’s time to start victim-blaming. unironically. don’t use npm, use #pnpm (or #bun).

pnpm stores your packages in a single central repository instead of downloading them all every time, and it also doesn’t run build scripts by default unless you ask it to. plus, it’s faster, but that’s less important.

if you use plain npm, you’re not a victim, you’re a perpetrator.

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @parcel/[email protected], [email protected], [email protected], [email protected]

Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.

this vibe coded PR with 1,000,000+ additions is just open-source ransomware with prettier commit messages.

shoutout to the brave soul reviewing:

"LGTM" after skimming 14 lines… 🤡

uninstalling immediately!

https://github.com/oven-sh/bun/pull/30412

#npm #yarn #pnpm #bun #deno #js #javascript #typescript

this vibe coded PR with 1,000,000+ additions is just open-source ransomware with prettier commit messages.

shoutout to the brave soul reviewing:

"LGTM" after skimming 14 lines… 🤡

uninstalling immediately!

https://github.com/oven-sh/bun/pull/30412

#npm #yarn #pnpm #bun #deno #js #javascript #typescript

this vibe coded PR with 1,000,000+ additions is just open-source ransomware with prettier commit messages.

shoutout to the brave soul reviewing:

"LGTM" after skimming 14 lines… 🤡

uninstalling immediately!

https://github.com/oven-sh/bun/pull/30412

#npm #yarn #pnpm #bun #deno #js #javascript #typescript

this vibe coded PR with 1,000,000+ additions is just open-source ransomware with prettier commit messages.

shoutout to the brave soul reviewing:

"LGTM" after skimming 14 lines… 🤡

uninstalling immediately!

https://github.com/oven-sh/bun/pull/30412

#npm #yarn #pnpm #bun #deno #js #javascript #typescript

pnpm 11.0リリース ——新規公開の依存パッケージをデフォルトで1日後に解決対象に
https://gihyo.jp/article/2026/04/pnpm-v11-release?utm_source=feed

#gihyo #技術評論社 #gihyo_jp #pnpm #JavaScript

pnpm 11.0, by @kochan.io (@pnpm):

https://pnpm.io/blog/releases/11.0

#releasenotes #pnpm

pnpm 11.0, by @kochan.io (@pnpm):

https://pnpm.io/blog/releases/11.0

#releasenotes #pnpm

pnpm 11.0, by @kochan.io (@pnpm):

https://pnpm.io/blog/releases/11.0

#releasenotes #pnpm

pnpm 11.0, by @kochan.io (@pnpm):

https://pnpm.io/blog/releases/11.0

#releasenotes #pnpm

pnpm 11.0, by @kochan.io (@pnpm):

https://pnpm.io/blog/releases/11.0

#releasenotes #pnpm

Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

Supply-chain security woes! Here's a simple configuration that will improve your PNPM security posture along with a nudge towards something even deeper!

https://coderlegion.com/14098/configuring-pnpm-to-tackle-the-supply-chain-bonfire

#NodeJS #Security #PNPM

Supply-chain security woes! Here's a simple configuration that will improve your PNPM security posture along with a nudge towards something even deeper!

https://coderlegion.com/14098/configuring-pnpm-to-tackle-the-supply-chain-bonfire

#NodeJS #Security #PNPM

Supply-chain security woes! Here's a simple configuration that will improve your PNPM security posture along with a nudge towards something even deeper!

https://coderlegion.com/14098/configuring-pnpm-to-tackle-the-supply-chain-bonfire

#NodeJS #Security #PNPM

Supply-chain security woes! Here's a simple configuration that will improve your PNPM security posture along with a nudge towards something even deeper!

https://coderlegion.com/14098/configuring-pnpm-to-tackle-the-supply-chain-bonfire

#NodeJS #Security #PNPM

Supply-chain security woes! Here's a simple configuration that will improve your PNPM security posture along with a nudge towards something even deeper!

https://coderlegion.com/14098/configuring-pnpm-to-tackle-the-supply-chain-bonfire

#NodeJS #Security #PNPM

pnpm 11 Beta 0, by @pnpm:

https://github.com/pnpm/pnpm/releases/tag/v11.0.0-beta.0

#releasenotes #pnpm

pnpm 11 Beta 0, by @pnpm:

https://github.com/pnpm/pnpm/releases/tag/v11.0.0-beta.0

#releasenotes #pnpm

pnpm 11 Beta 0, by @pnpm:

https://github.com/pnpm/pnpm/releases/tag/v11.0.0-beta.0

#releasenotes #pnpm

pnpm 11 Beta 0, by @pnpm:

https://github.com/pnpm/pnpm/releases/tag/v11.0.0-beta.0

#releasenotes #pnpm

pnpm 11 Beta 0, by @pnpm:

https://github.com/pnpm/pnpm/releases/tag/v11.0.0-beta.0

#releasenotes #pnpm

https://blog.gslin.org/archives/2026/04/01/12962/axios-%e8%a2%ab%e6%a4%8d-malware/

axios 被植 malware

#attack #axios #bun #chain #code #ecosystem #javascript #js #malicious #malware #npm #pnpm #python #security #supply #uv

https://blog.gslin.org/archives/2026/04/01/12962/axios-%e8%a2%ab%e6%a4%8d-malware/

axios 被植 malware

#attack #axios #bun #chain #code #ecosystem #javascript #js #malicious #malware #npm #pnpm #python #security #supply #uv

https://blog.gslin.org/archives/2026/04/01/12962/axios-%e8%a2%ab%e6%a4%8d-malware/

axios 被植 malware

#attack #axios #bun #chain #code #ecosystem #javascript #js #malicious #malware #npm #pnpm #python #security #supply #uv

https://blog.gslin.org/archives/2026/04/01/12962/axios-%e8%a2%ab%e6%a4%8d-malware/

axios 被植 malware

#attack #axios #bun #chain #code #ecosystem #javascript #js #malicious #malware #npm #pnpm #python #security #supply #uv

https://blog.gslin.org/archives/2026/04/01/12962/axios-%e8%a2%ab%e6%a4%8d-malware/

axios 被植 malware

#attack #axios #bun #chain #code #ecosystem #javascript #js #malicious #malware #npm #pnpm #python #security #supply #uv

[小ネタ] 生成されたファイル類(package-lock.json など)がコンフリクトしたら真面目にマージしないで
https://qiita.com/ssc-ksaitou/items/667ef87273d3aa78bfae?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Git #npm #小ネタ #package_json #pnpm

[小ネタ] 生成されたファイル類(package-lock.json など)がコンフリクトしたら真面目にマージしないで
https://qiita.com/ssc-ksaitou/items/667ef87273d3aa78bfae?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Git #npm #小ネタ #package_json #pnpm

次世代パッケージマネージャーpnpmは何が違うのか？設計思想から読み解く依存管理
https://qiita.com/t0hara/items/e97168314c00ce166286?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Node_js #npm #パッケージ管理 #YARN #pnpm

次世代パッケージマネージャーpnpmは何が違うのか？設計思想から読み解く依存管理
https://qiita.com/t0hara/items/e97168314c00ce166286?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Node_js #npm #パッケージ管理 #YARN #pnpm

🚀 Deploy OpenStatus on Debian VPS (5 Minute Quick-Start Guide) #bun #certbot #corepack #debian #letsencrypt #monitoring #nginx #nodejs #openstatus #pnpm #selfhosted #selfhosting #statuspage #turso #vps #Cloud #Guides #VPS

🚀 Deploy OpenStatus on Debian ...

🚀 Deploy OpenStatus on Debian VPS (5 Minute Quick-Start Guide) #bun #certbot #corepack #debian #letsencrypt #monitoring #nginx #nodejs #openstatus #pnpm #selfhosted #selfhosting #statuspage #turso #vps #Cloud #Guides #VPS

🚀 Deploy OpenStatus on Debian ...