Security vulnerabilities and automated fixes for package security issues
1 post found
A missing `trustPolicy` configuration in `pnpm-workspace.yaml` left a Node.js library vulnerable to supply chain attacks where malicious package updates could downgrade security settings. Combined with insufficient input validation in the todo application component, this created a medium-severity attack surface. The fix adds `trustPolicy: no-downgrade`, `blockExoticSubdeps: true`, and `minimumReleaseAge: 10080` to harden the package manager configuration.