
3 pnpm Settings to Protect Yourself from Supply Chain Attacks
Secure your pnpm projects by quarantining new releases, blocking exotic subdependencies, and restricting build scripts.
Package managers, dependency management, software distribution, registries, and related tooling across programming ecosystems.

Secure your pnpm projects by quarantining new releases, blocking exotic subdependencies, and restricting build scripts.

A self-propagating supply-chain attack has poisoned TanStack Router npm packages to steal credentials and infect further repositories.

A hijacked maintainer account was used to poison the axios npm package with a sophisticated, self-cleaning Remote Access Trojan targeting multiple operating systems.

The litellm PyPI package has been compromised by a supply chain attack that automatically steals and exfiltrates sensitive system credentials and secrets.
We know how to fix JavaScript’s dependency mess, but the industry will choose symbolic gestures over real reforms.

A shared repo’s GitHub Actions secret was exfiltrated via a malicious workflow, enabling malicious npm publishes; the author has locked down publishing now and is moving toward OIDC to eliminate static tokens.
Microsoft’s control of npm hasn’t fixed its core weaknesses, leaving the JavaScript supply chain dangerously insecure and enterprises exposed.

A self-propagating npm attack backdoored @ctrl/tinycolor and 40+ packages to steal multi-cloud and GitHub secrets, persist via Actions workflows, and exfiltrate data—demanding immediate removal, credential rotation, and CI/CD hardening.