Security vulnerabilities and automated fixes for package manager issues
1 post found
A missing `trustPolicy` setting in `pnpm-workspace.yaml` left a Node.js workspace vulnerable to malicious packages silently downgrading security configurations. The fix adds `trustPolicy: no-downgrade` alongside `blockExoticSubdeps: true` and a stricter `minimumReleaseAge`, closing a supply-chain attack primitive before it could be chained with other weaknesses.