The TanStack npm Attack Shows Why pnpm 11 Matters (opens in new tab)

On April 28, 2026, pnpm 11 was released with some of the strongest security defaults we've seen from a mainstream JavaScript package manager. The release follows a wave of npm supply chain attacks, including the recent TanStack compromise and the broader Mini Shai Hulud campaign. Both incidents exposed weaknesses in GitHub Actions workflows, CI/CD pipelines, and automated dependency installs. Modern frontend applications often depend on hundreds or thousands of transitive npm packages, which ...