#pnpm articles | Hashnode

🛡️Your node_modules Is an Attack Surface: A Practical npm Security Checklist for 2026

Axios, TanStack, Shai-Hulud: the 2026 npm supply chain attacks explained, plus a practical checklist to secure your installs, CI/CD and dependencies.

9 min readshubham-works.hashnode.dev

4

Waseem AnjumNov 3

pnpm vs npm Security in 2026: Install Scripts and Release Age, Tested

pnpm vs npm security, tested with a postinstall canary: what npm 11, npm 12 and pnpm 12 block by default, plus the release-age settings to turn on.

7 min readfabwaseem.hashnode.dev

Sonali ParekhOct 23

Set up a monorepo you can still maintain in a year

A pnpm and Turborepo foundation with a working API, shared packages and commit checks.

17 min readsonaliparekh.hashnode.dev

Joel ChenOct 7

Rust vs Node.js for a package manager - tuning fyn on pnpm benchmarks

How much does Rust bring to a package manager? I tuned fyn on pnpm's benchmark. In Node.js it gets 54-73% of pnpm 12's speedup over pnpm 11 on Linux.

15 min readjchip.hashnode.dev

Kanishka ChowdhuryOct 4

Simple ways to guard your packages from supply-chain attacks 🛡️

Practical pnpm guardrails against supply-chain attacks: release age, blocked install scripts, audits, Dependabot, and an agent to fix alerts safely.

10 min readbits2bytes.hashnode.dev

1

Anthony LucasSep 17

Reduce Expo Monorepo CI Build Time

Reduce Expo monorepo CI build time with correct app boundaries, pnpm store cache, per-app Metro cache, and EAS cache for native steps.

2 min readmake-it-run-blog.hashnode.dev

Shubham Kumar SinghSep 5

Building the Frontend of CodeLens AI with TanStack Start

Explore how I built the CodeLens AI frontend with TanStack Start, React, TanStack Query, and pnpm monorepo, with scalable tooling and architecture.

20 min readshubhamsinghbundela.hashnode.dev

6

Pranav PandeyJul 6

The Monorepo Glue: pnpm, Metro, and NestJS in One Workspace

The previous post covered why Expo earned its place in a white-label mobile stack — how app.config.js replaces per-tenant Xcode projects, how OTA updates create a middle release tier, how a shared com

8 min readpranavdev.hashnode.dev

Emeka Afamefuna NwosaJun 14

Deploying a Next.js SSR App to AWS Amplify (the stuff nobody tells you)

Deploying a Next.js SSR app to AWS Amplify? Here are the three gotchas that cost us hours: unsupported Node versions, SSR env vars vanishing at runtime, and a pnpm build failure.

11 min reademeka-nwosa.hashnode.dev