News for hackers. Stuff that matters.
Re:Oh no, not again a meditation on NPM supply chain attacks by Hexshin0bi on Thursday September 18, 2025 @03:38AM (#45286723)
"...but also disables post-install scripts by default."

in pnpm docs it says:

""" enablePrePostScripts Default: true Type: Boolean When true, pnpm will run any pre/post scripts automatically. So running pnpm foo will be like running pnpm prefoo && pnpm foo && pnpm postfoo. """

am i missing something here?

Re:Oh no, not again a meditation on NPM supply chain attacks by zkochan on Thursday September 18, 2025 @11:20AM (#45290770)
enablePrePostScripts is about running "prebuild" and "postbuild" scripts automatically, when you run "pnpm run build"
Re:Oh no, not again a meditation on NPM supply chain attacks by zkochan on Thursday September 18, 2025 @11:21AM (#45290778)
well, it is literally in an example in the text that you provided. So, I am not sure why you confused it with postinstall lifecycle scripts.