npm – Jacar

View options

View Cards

Mode Paginated

Per page Per batch 48

Filters

How to harden npm against supply chain attacks with allowScripts and min-release-age

npm 11.19 ships two defences against compromised packages: allowScripts, which makes you approve each dependency's install scripts, and min-release-age, which ignores versions published less than N days ago. Together they would have stopped August 2026's ChainDrop worm, which spread through a preinstall hook and fresh patch releases.

October 27, 2026 7 min 8

Technology

Deno 2.0: Node compatibility without losing identity

Deno 2.0, released in October 2024, reads package.json, creates node_modules, and works with pnpm, so moving an existing project onto it is no longer a rewrite. Node compatibility is better than ever but still not total, and large frameworks remain the rough edge. Sandboxed permissions and native TypeScript without tsc are unchanged.

March 4, 2025 7 min 229 4.3