PNPM 10.16 Introduces Security Delay Feature Amid Supply Chain Attack Concerns

The JavaScript package management world has been shaken by recent supply chain attacks targeting popular packages. In response, PNPM 10.16 has introduced a groundbreaking security feature that delays the installation of newly released dependencies, sparking intense debate within the developer community about balancing security with the fast-paced nature of modern web development.

The Security Dilemma: Speed vs Safety

The new minimumReleaseAge setting allows developers to specify how many minutes must pass after a package is published before PNPM will install it. This approach aims to create a buffer zone where malicious packages can be detected and removed before they spread widely. The feature comes with an exclusion list for trusted packages that need immediate updates.

However, the community is divided on implementation details. Many developers are questioning the choice of minutes as the unit, suggesting that ISO8601 duration standards would be more intuitive and consistent with industry practices.

PNPM 10.16 Key Security Features:

• minimumReleaseAge: Delays package installation by specified minutes
• minimumReleaseAgeExclude: Allows exceptions for trusted packages
• Default recommendation: 1440 minutes (24 hours) delay
• Finder functions: Custom dependency search criteria
• Enhanced pnpm list and pnpm why commands with --find-by flag

The Canary Problem: Who Tests First?

A fascinating discussion has emerged around what developers call the canary problem. If everyone delays package installations by several days, who will be the first to detect compromised packages? The community seems to have found an unexpected answer: NPM users will continue to serve as early adopters, while PNPM users benefit from the delayed installation safety net.

A lot of people will still use npm, so they'll be the canaries in the coal mine

This creates an interesting ecosystem dynamic where different package managers serve different risk profiles within the JavaScript community.

JavaScript's Unique Update Culture

The debate has also highlighted fundamental differences between JavaScript and other programming ecosystems. While C++ developers might wait months before adopting new dependencies, JavaScript developers often update packages within days or weeks. This urgency stems from the security-critical nature of web applications and the semantic versioning system that promises safe minor updates.

The community discussion reveals that most JavaScript applications are network-connected and face constant security threats, making quick security patches essential. However, this same urgency creates vulnerability windows that attackers can exploit.

Configuration Example:

minimumReleaseAge: 1440   24 hours in minutes
minimumReleaseAgeExclude:
  - webpack
  - react

Finder Function Example:

module.exports = {
  finders: {
    react17: (ctx) => {
      return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    }
  }
}

Advanced Dependency Analysis Tools

Beyond security delays, PNPM 10.16 introduces finder functions that allow developers to search dependencies by custom criteria rather than just package names. This feature enables complex queries like finding all packages with specific peer dependencies or license types, giving developers better visibility into their dependency trees.

The combination of security delays and enhanced analysis tools represents a maturing approach to dependency management, where visibility and caution work together to improve overall security posture.

The release reflects a broader shift in the JavaScript ecosystem toward more defensive development practices, acknowledging that the speed and convenience that made NPM popular also created security vulnerabilities that need systematic solutions.

Reference: pnpm 10.16