News for hackers. Stuff that matters.
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by lrvick on Tuesday September 16, 2025 @02:54AM (#45258902)
pnpm cannot be built from source without an existing pnpm binary making it ineligible for inclusion in any reproducible Linux distro, for good reason, as there is no way to rule out a trusting trust attack.

Pnpm should be considered for hobby use cases only.

There are no comments on this comment yet.