News for hackers. Stuff that matters.

A comment on Pnpm has a new setting to stave off supply chain attacks. Parent comment

Re:Pnpm has a new setting to stave off supply chain attacks by __MatrixMan__ on Thursday September 18, 2025 @08:15AM (#45288675)
Those are promises that npm intends to keep, but whether they do or not isn't something that you as a package user can verify. Plus there's also the possibility that the server you got those bits from was merely masquerading as npm.

The only immutability that counts is immutability that you can verify, which brings us back to cryptographic hashes.

[ Parent | on HN ]
Re:Pnpm has a new setting to stave off supply chain attacks by mirekrusin on Thursday September 18, 2025 @05:32PM (#45295263)
...which are already present in lockfiles, available in registry ie. https://registry.npmjs.org/debug etc. - it's not a problem.
[ Parent | on HN ]