News for hackers. Stuff that matters.

Hexshin0bi

Re:Oh no, not again a meditation on NPM supply chain attacks on Thursday September 18, 2025 @03:38AM (#45286723)
"...but also disables post-install scripts by default."

in pnpm docs it says:

""" enablePrePostScripts Default: true Type: Boolean When true, pnpm will run any pre/post scripts automatically. So running pnpm foo will be like running pnpm prefoo && pnpm foo && pnpm postfoo. """

am i missing something here?