Re:Active NPM supply chain attack: Tinycolor and 40 Packages...
by lrvick on Tuesday September 16, 2025 @02:54AM
(#45258902)
pnpm cannot be built from source without an existing pnpm binary making it ineligible for inclusion in any reproducible Linux distro, for good reason, as there is no way to rule out a trusting trust attack.
Pnpm should be considered for hobby use cases only.
Pnpm should be considered for hobby use cases only.