--- title: "#pnpm articles | Hashnode" description: "Explore 109 articles tagged #pnpm on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/pnpm" --- Tag # #pnpm 109 posts · 19 followers [Shubham Chaudhary](https://hashnode.com/@shubhamworks) · [Nov 3](https://hashnode.com/posts/your-node-modules-is-an-attack-surface-a-practical-npm-security-checklist-for-2026/6ae98d90dede7c42d8c2d00e) ### [🛡️Your node\_modules Is an Attack Surface: A Practical npm Security Checklist for 2026](https://shubham-works.hashnode.dev/your-node-modules-is-an-attack-surface-a-practical-npm-security-checklist-for-2026?utm_source=hashnode&utm_medium=feed) Axios, TanStack, Shai-Hulud: the 2026 npm supply chain attacks explained, plus a practical checklist to secure your installs, CI/CD and dependencies. 9 min read · [shubham-works.hashnode.dev](https://shubham-works.hashnode.dev/your-node-modules-is-an-attack-surface-a-practical-npm-security-checklist-for-2026?utm_source=hashnode&utm_medium=feed) [4](https://hashnode.com/posts/your-node-modules-is-an-attack-surface-a-practical-npm-security-checklist-for-2026/6ae98d90dede7c42d8c2d00e) [Waseem Anjum](https://hashnode.com/@fabwaseem) · [Nov 3](https://hashnode.com/posts/pnpm-vs-npm-security/6aea5c1db239b3423a01e37a) ### [pnpm vs npm Security in 2026: Install Scripts and Release Age, Tested](https://fabwaseem.hashnode.dev/pnpm-vs-npm-security?utm_source=hashnode&utm_medium=feed) pnpm vs npm security, tested with a postinstall canary: what npm 11, npm 12 and pnpm 12 block by default, plus the release-age settings to turn on. 7 min read · [fabwaseem.hashnode.dev](https://fabwaseem.hashnode.dev/pnpm-vs-npm-security?utm_source=hashnode&utm_medium=feed) [Sonali Parekh](https://hashnode.com/@sonaliparekh) · [Oct 23](https://hashnode.com/posts/typescript-monorepo-pnpm-turborepo-nestjs/6adb96ef194adc05b9790cdb) ### [Set up a monorepo you can still maintain in a year](https://sonaliparekh.hashnode.dev/typescript-monorepo-pnpm-turborepo-nestjs?utm_source=hashnode&utm_medium=feed) A pnpm and Turborepo foundation with a working API, shared packages and commit checks. 17 min read · [sonaliparekh.hashnode.dev](https://sonaliparekh.hashnode.dev/typescript-monorepo-pnpm-turborepo-nestjs?utm_source=hashnode&utm_medium=feed) [Joel Chen](https://hashnode.com/@jchip) · [Oct 7](https://hashnode.com/posts/rust-vs-node-js-for-a-package-manager-tuning-fyn-on-pnpm-benchmarks/6ac69f4a77811b5c183439df) ### [Rust vs Node.js for a package manager - tuning fyn on pnpm benchmarks](https://jchip.hashnode.dev/rust-vs-node-js-for-a-package-manager-tuning-fyn-on-pnpm-benchmarks?utm_source=hashnode&utm_medium=feed) How much does Rust bring to a package manager? I tuned fyn on pnpm's benchmark. In Node.js it gets 54-73% of pnpm 12's speedup over pnpm 11 on Linux. 15 min read · [jchip.hashnode.dev](https://jchip.hashnode.dev/rust-vs-node-js-for-a-package-manager-tuning-fyn-on-pnpm-benchmarks?utm_source=hashnode&utm_medium=feed) [Kanishka Chowdhury](https://hashnode.com/@KanishkDev) · [Oct 4](https://hashnode.com/posts/simple-ways-to-guard-your-packages-from-supply-chain-attacks/6ac2a1b6b8764a05f44044ec) ### [Simple ways to guard your packages from supply-chain attacks 🛡️](https://bits2bytes.hashnode.dev/simple-ways-to-guard-your-packages-from-supply-chain-attacks?utm_source=hashnode&utm_medium=feed) Practical pnpm guardrails against supply-chain attacks: release age, blocked install scripts, audits, Dependabot, and an agent to fix alerts safely. 10 min read · [bits2bytes.hashnode.dev](https://bits2bytes.hashnode.dev/simple-ways-to-guard-your-packages-from-supply-chain-attacks?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/simple-ways-to-guard-your-packages-from-supply-chain-attacks/6ac2a1b6b8764a05f44044ec) [Anthony Lucas](https://hashnode.com/@devops-make-it-run) · [Sep 17](https://hashnode.com/posts/reduce-expo-monorepo-ci-build-time/6aabbddb688422bd87257db4) ### [Reduce Expo Monorepo CI Build Time](https://make-it-run-blog.hashnode.dev/reduce-expo-monorepo-ci-build-time?utm_source=hashnode&utm_medium=feed) Reduce Expo monorepo CI build time with correct app boundaries, pnpm store cache, per-app Metro cache, and EAS cache for native steps. 2 min read · [make-it-run-blog.hashnode.dev](https://make-it-run-blog.hashnode.dev/reduce-expo-monorepo-ci-build-time?utm_source=hashnode&utm_medium=feed) [Shubham Kumar Singh](https://hashnode.com/@shubhamsinghbundela) · [Sep 5](https://hashnode.com/posts/building-the-frontend-of-codelens-ai-with-tanstack-start/6a9c1ce1a475307ff949d2ef) ### [Building the Frontend of CodeLens AI with TanStack Start](https://shubhamsinghbundela.hashnode.dev/building-the-frontend-of-codelens-ai-with-tanstack-start?utm_source=hashnode&utm_medium=feed) Explore how I built the CodeLens AI frontend with TanStack Start, React, TanStack Query, and pnpm monorepo, with scalable tooling and architecture. 20 min read · [shubhamsinghbundela.hashnode.dev](https://shubhamsinghbundela.hashnode.dev/building-the-frontend-of-codelens-ai-with-tanstack-start?utm_source=hashnode&utm_medium=feed) [6](https://hashnode.com/posts/building-the-frontend-of-codelens-ai-with-tanstack-start/6a9c1ce1a475307ff949d2ef) [Pranav Pandey](https://hashnode.com/@pranav_pandey) · [Jul 6](https://hashnode.com/posts/the-monorepo-glue-pnpm-metro-and-nestjs-in-one-workspace/6a4b806bd0d6890db1e3400e) ### [The Monorepo Glue: pnpm, Metro, and NestJS in One Workspace](https://pranavdev.hashnode.dev/the-monorepo-glue-pnpm-metro-and-nestjs-in-one-workspace?utm_source=hashnode&utm_medium=feed) The previous post covered why Expo earned its place in a white-label mobile stack — how app.config.js replaces per-tenant Xcode projects, how OTA updates create a middle release tier, how a shared com 8 min read · [pranavdev.hashnode.dev](https://pranavdev.hashnode.dev/the-monorepo-glue-pnpm-metro-and-nestjs-in-one-workspace?utm_source=hashnode&utm_medium=feed) [Emeka Afamefuna Nwosa](https://hashnode.com/@gaffer22) · [Jun 14](https://hashnode.com/posts/nextjs-ssr-aws-amplify-gotchas/6a2eb56b7860389b49f2ded4) ### [Deploying a Next.js SSR App to AWS Amplify (the stuff nobody tells you)](https://emeka-nwosa.hashnode.dev/nextjs-ssr-aws-amplify-gotchas?utm_source=hashnode&utm_medium=feed) Deploying a Next.js SSR app to AWS Amplify? Here are the three gotchas that cost us hours: unsupported Node versions, SSR env vars vanishing at runtime, and a pnpm build failure. 11 min read · [emeka-nwosa.hashnode.dev](https://emeka-nwosa.hashnode.dev/nextjs-ssr-aws-amplify-gotchas?utm_source=hashnode&utm_medium=feed) [Atul Rajput](https://hashnode.com/@eatulrajput) · [May 12](https://hashnode.com/posts/npm-yarn-pnpm-and-bun/6a02ddce937b84f7793dbc0b) ### [npm , yarn, pnpm and bun](https://eatulrajput.hashnode.dev/npm-yarn-pnpm-and-bun?utm_source=hashnode&utm_medium=feed) Let's explore package manager of JavaScript 7 min read · [eatulrajput.hashnode.dev](https://eatulrajput.hashnode.dev/npm-yarn-pnpm-and-bun?utm_source=hashnode&utm_medium=feed)