mr. TIM
not really a js dev, but claude moved me to pnpm. what is it and why should i want it?
1 2
Samuel
it’s a package manager. it’s in charge of putting your deps into node_modules. compared to npm/yarn, pnpm is way faster and has way more security features
1 3
KiloQubit
Does it still allow installation scripts to perform arbitrary actions on your machine?
2
Samuel
@samuel.fm
no you have to manually whitelist the ones that are allowed to run postinstall scripts
1 1
KiloQubit
I guess it's a little better, but I think it should be way more restrictive. It should prevent the scripts from touching any files outside of that package's directory, or open any network (or unix socket) connections to anything, or seeing any environment vars other than its own,
1
KiloQubit
Or seeing current processes or being able to send signals to processes other than its own.