3 pnpm Settings to Protect Yourself from Supply Chain Attacks

Supply chain attacks are surging – and it's only going to get worse. The most recent example is Mini Shai-Hulud, which affected intercom-client (npm), mbt (npm), @cap-js/* (npm), and lightning (PyPI).

If you are using pnpm, here are three settings you should enable today.

This quarantines newly published packages for a specified period before they can be installed. Most malicious packages are detected and removed within days of publication. Setting this to 7 days means you'll never install a fresh supply chain attack.

# .npmrc
minimum-release-age=10080

or

# pnpm-workspace.yaml
minimumReleaseAge: 10080

The value is in minutes. 10080 = 7 days.

This blocks subdependencies that use exotic specifiers like git: or remote tarball URLs. Attackers use these to pull code from arbitrary sources, bypassing the registry entirely.

# .npmrc
block-exotic-subdeps=true

or

# pnpm-workspace.yaml
blockExoticSubdeps: true

pnpm 10+ blocks dependency install scripts by default. allowBuilds controls which packages are explicitly permitted to run build scripts, so only the ones you trust can execute code on your machine.

# pnpm-workspace.yaml
allowBuilds:
  esbuild: true
  sharp: true

Run pnpm approve-builds to interactively review and approve packages that need build scripts.

On pnpm versions older than 10.26, use onlyBuiltDependencies instead:

# pnpm-workspace.yaml
onlyBuiltDependencies:
  - esbuild
  - sharp

Both npm and Yarn Berry have partial equivalents:

pnpmnpmYarn Berry
minimumReleaseAgemin-release-age (npm 11.10+)npmMinimalAgeGate (Yarn 4.10+)
blockExoticSubdepsNo equivalentapprovedGitRepositories (Yarn 4.14+)
allowBuildsNo equivalent (ignore-scripts is all-or-nothing)enableScripts: false + dependenciesMeta.*.built: true

Yarn 4.14 just added approvedGitRepositories to control which git: URL patterns are allowed in subdependencies. This is similar to pnpm's blockExoticSubdeps, though scoped to git URLs rather than blocking all exotic specifiers (git, tarball, etc.) outright.

pnpm remains the only package manager that covers all three out of the box.