/ tags/ javascript

# Pinning the Node.js version with pnpm, without nvmEN

2026-07-16Alessandro Corbelli~5 min

pnpm can manage the Node.js version too: with devEngines the project declares the runtime it needs and pnpm downloads it, uses it and locks it in the lockfile - no nvm required. Tested examples and…

devops pnpm javascript nodejs nvm

Read

# Compromised npm packages: what happened and how a cooldown period protects youEN

2026-07-16Alessandro Corbelli~7 min

The waves of compromised npm packages - from chalk/debug to the Shai-Hulud worm and the 2026 episodes - and a simple, effective defence: pnpm's minimumReleaseAge, with tested configuration examples.

security npm supply-chain pnpm javascript

Read